While collaboration in research requires the publication of data as well as exchange of them between institutions, these data often contain personal information that according to ethical requirements and existing legislature, are not allowed to be disclosed. Anonymization of these data is therefore mandatory. In previous work we have presented a framework for anonymizing patient data using Data Cubes. Though efficient for anonymization, the Data Cubes approach often lacks in flexibility. In the current work, we present an alternative approach which is based on disclosing a row based anonymized version of the original data set. The methodology is more versatile, while it also preserves the statistical characteristics of the original data set. We demonstrate this by considering an SVM predictor that tries to estimate the value of Breslow's depth, based on the values of another clinical variable, namely Clark's level, and the expression count of a skin cancer related gene (CDKN2A). The predictions are shown to have the same characteristics for both the original and the anonymized data sets.
While publication and exchange of clinical and genetic data is crucial for research, it is
often the case that data contain sensitive information; information that, if disclosed,
may cause harm to the patients. It is therefore mandatory, both in ethical and in legal
terms, to respect and protect the individual’s right to anonymity for the patients whose
data are used for research. With the advent of GDPR[
In previous work[
The first one was that of inflexibility. In order to produce a Data Cube, a set of attributes and a categorization schema for each one of these attributes was chosen. If, however, other attributes were to be added or removed, the Data Cube needed to be reconstructed from start.
The second one was the one of performance. When combining clinical and genetic
data, which are typically stored in different files, the amount of join operations led to a
growth of the required amount of time needed to prepare data for processing. This
growth, while polynomial, still poses a limiting factor when producing large Data
Cubes. Although it has been demonstrated that by using High Performance Computing
techniques, this overhead can be reduced by a cubic factor[
In this work we introduce a new methodology that performs anonymization directly in the patient data. The transformation may be applied to the whole data set, which is then distributed in row format. Since the transformation is applied at the row level, it is linear in time and attributes of interest can be removed/added in a time efficient manner. The methodology will be applied in a use case that involves data of patients treated for melanoma.
This work was funded in the context of the SAGE-CARE[
In the most direct sense, a set is to be considered anonymized if no personal information
of the data subjects is exposed to potential attacker. In the case of row-based format of
data, this means that an individual cannot be linked to her corresponding entry in the
data set. In a typical case however, especially those involving patient data,
anonymization must be forced in the stricter sense, so that not only personal but also sensitive
information is protected[
Membership disclosure, involves the knowledge of whether data regarding an individual are contained in the dataset or not. Attribute disclosure, involves the knowledge of whether a specific attribute, has a specific value for an individual. Membership and attribute disclosure allow an attacker to discern sensitive information regarding individual(s), even without re-identifying the data set. For example, if an attacker knows that a subject is part of a double-blind placebo control clinical trial for a new drug developed for melanoma, then she knows that the subject has melanoma with a probability ~50%.
The different disclosure cases force the categorization of subject attributes into four types: • Identifying attributes, that contain subject’s personal identifiable information (PII) and which are, in any case, removed from the set. • Quasi-identifying (QIA) attributes which though they cannot be used on their own to identify a subject, they can be used, in combination with other variables to identify subjects. • Sensitive attributes (SA), which contain information about subjects with which the subject should not be associated with. The presence of melanoma referred to earlier is a typical example of a sensitive attribute. Genetic information, which can now be linked to existing or potential health issues, such as predisposition to cancer, is also considered sensitive information. • Non-sensitive attributes, which are irrelevant for the purposes of re-identification
QIA are transformed, while sensitive attributes are transmitted as is, provided that certain constraints are held. These constraints are enforced to prevent re-identification and are defined by the so-called privacy models 2.1
Privacy Models Privacy models concerning anonymization can be very diverse; for the purposes of the present work we consider only the ones that are relevant to the use case of melanoma patients to be presented.
• k-anonymity[
Figure 1 depicts a simple example demonstrating the meaning of k and l values. Anonymization with the desired characteristics is achieved with performing transformation on the QIA; the most typical ones are generalization, where values are grouped under categories, and suppression, where part of the information is masked.
In the case of patient data, anonymization needs to be such that no sensitive information may be attributed to a single patient. The transformed data set however, needs to exhibit the same statistical characteristics as the original one; otherwise the dataset will lose its validity and will be of no scientific value to the entities that share the information. For the purposes of the current work, we considered datasets that contain data of patients that were treated for melanoma. These data were retrieved in the context of the SAGECARE project and correspond to real patient data that are stripped from any PII. They contained both phenotypical information, concerning the clinical picture of the patient as well as genetic information corresponding to expression counts of the patient’s genes. Satellite data, contained subject’s information such as height, ethnicity etc. are also included in the dataset. These satellite data will be considered QIA in our model.
For anonymizing the dataset, we transform the set by requiring a k-value of 5,
lvalue of 2 and t-closeness of 0.2. The transformation is carried out by using the ARX
framework[
ARXConfiguration config = ARXConfiguration.create();
config.addPrivacyModel(new KAnonymity(5));
config.setSuppressionLimit(0.02d);
data.getDefinition().setAttributeType("breslow-depth",
Type.SENSITIVE_ATTRIBUTE);
Attributeconfig.addPrivacyModel(new EqualDistanceTCloseness("breslow-depth", 0.2d));
// l-diversity
config.addPrivacyModel(new DistinctLDiversity("breslow-depth ", 2));
To demonstrate that the transformation allows the data set to keep its main predictive
features, we will show how a typical Support Vector Machine [
Figure 4 depicts the same classification when applied in the anonymized data set. Taking into account the difference in the scaling produced between the two cases, the classification has the same characteristics. It is to be noted, that the aim of the above experiment is not to extract any significant medical conclusions; indeed there are far more elaborate statistical models to demonstrate correlations between various phenotypical and genetic attributes. The main goal of the experiment is to demonstrate that the anonymized data set has the same statistical characteristics and that any conclusions drawn from the original data set, persist to the anonymized one.
In the present paper we demonstrated that datasets containing phenotypical and genetic data can be effectively anonymized, with any information loss not leading to a substantial change to the data’s statistical characteristics. The methodology can be applied to patient data and these can be shared between parties in a manner that does not compromise patients’ personal and sensitive information and that is also compliant with the requirements of GDPR. The transformed data moreover, exhibit the same statistical characteristics as the original data; their scientific value is therefore not compromised by the anonymization transformations.
Further work involves demonstrating the same result by using a model that will be proven to be applicable to a generic case, involving arbitrary number of attributes; the model will also provide metrics that will indicate the amount of information loss imposed by the transformation, thereby quantizing the efficiency of the anonymization.