5 ms·

1) UK is not the US, and the EU has much stricter privacy laws 2) There is not such thing as "anonymized data" that is gathered by companies. There are several

by mtgx 10y ago

1) UK is not the US, and the EU has much stricter privacy laws 2) There is not such thing as "anonymized data" that is gathered by companies. There are several studies out there that show that with only 4 data points you can pinpoint someone in an "anonymized database" with 90% accuracy. Even Apple's differential privacy can probably be reverse engineered to find people. Just because you don't care to do that, doesn't mean others wouldn't do that either.

throwaway729 10y ago
> Just because you don't care to do that, doesn't mean others wouldn't do that either. More to the point, author almost certainly operated under a heavily and independently vetted IRB protocol that would have made such a purposeful re-identification a criminal or at least very serious civil offense.
- aub3bhat 10y ago
  True in fact the very disks that are used to distribute this data have printed warning that its misuse is a felony offense.
  - throwaway729 10y ago
    So, do you believe that the sticker was appropriate? Or would a PR statement from your university's press office have been more appropriate? Ultimately, the lack of a legally binding contractual obligation with sufficient audit-ability is primarily what Julia Powles & Hal Hodson are criticizing.
    - aub3bhat 10y ago
      >> lack of legally binding From the verge article: "The data-sharing agreement — which was signed in 2015" There was a legally binding contractual agreement between the two parties Deep Mind & Royal Free. Here is the one that I and thousands (I am NOT exaggerating) of other researchers regularly sign to get access to data. https://www.hcup-us.ahrq.gov/team/NationwideDUA.jsp https://www.hcup-us.ahrq.gov/team/NationwideDUA.jsp
      - throwaway729 10y ago
        > There was a legally binding contractual agreement between the two parties Deep Mind & Royal Free. Which was, allegedly, far too lax. The claim that DeepMind was providing "direct care" is particularly questionable IMO, and that has significant implications in the context of this agreement. It means anyone who slaps together an iPhone app (and has the right clout/deep pockets) can get access to full and fully identified medical records without patient consent. IMO that's the big story here, and it's troubling. The "don't worry that's covered by existing law" responses were also problematic. Why does this particular contract need to depend upon the enforce-ability of that law? What happens if the law is repealed and DeepMind happened to keep a copy of the data? We want the protection here, in this context, so just put it in this agreement. Which is what they ultimately did in the new agreement AFAICT. Also, the data shared is extremely broad -- I doubt you could get access to a data set of that size and quality without patient consent through standard channels, for example. I've never seen an identifiable data set containing "not only to relevant blood tests and diagnostics, but historical medical records dating back five years, including information on HIV diagnoses, drug overdoses, and abortions" for 1.6 million people. Access to such sensitive data creates a difference in kind that justifies greater care and skepticism, especially WRT audit-ability. The parties appear to agree, since they signed a new agreement recently! Demonize these researchers all you want, but as a direct result of their work, NHS patients have stronger legal protections today than they did a year ago.
        aub3bhat 10y ago
        >>> It means anyone who slaps together an iPhone app can get access to full medical records. Ummm thats how the world works, frankly its like saying water is wet. Whenever a hospital works with any third party provider, it signs a BAA agreement which governs the sharing of data. All risks of disclosure, etc. are priced into the contract. Any large hospital will have dedicated group of lawyers for sole purpose of drawing up these agreements. >> NHS patients have stronger legal protections today than they did a year ago. No they don't. For starters Deep Mind has not even returned any collected data.
        10y ago
aub3bhat 10y ago
1. UK is not in EU. The argument is that such arrangements are commonplace and I am sure one can find other such examples of data sharing in UK. 2. LOL yeah you are so damn clueless that I wont even bother replying. Lets just say there is reading some popular press article about privacy and annonymity. And then there is knowing intricate details of how business/research is conducted.
- JorgeGT 10y ago
  UK is in the EU until 2 years after Article 50 gets invoked, and EU data protection rules fully apply. This is a fact. The rude insult to another user, I won't even address.
  - aub3bhat 10y ago
    If EU data protection rules apply then why aren't the authors marching to doors of EU Privacy Commisioner demnding to prosecute Google? The reality is that what is Deep Mind did is routine and commonplave, and that's why no one other than clickbait driven press is interested in it.
    - Silhouette 10y ago
      The ICO (the UK data protection authority) has an ongoing investigation into the deal. This is even mentioned in the original report.
    - throwaway729 10y ago
      > is routine and commonplave Then go ahead and try to get access to a similar data set. Unaudited access to fully identified and full medical records going back a half decade for 1.6 million people, without obtaining individual permission or providing any individual notice. For nothing other than the promise of some diagnostic assistance software. As a for-profit company. Good luck greasing those wheels ;-)
- Silhouette 10y ago
  From your comments here, it appears that you're doing PhD research dealing with large sets of healthcare data. It also appears that you are casually dismissive of concerns about the risks of that data being de-anonymised. Your best rebuttal seems to be some vague allusion that the parent poster, who was essentially correct, didn't know what they were talking about. (This is something of a digression anyway, because in the actual case we're talking about, as the report notes, the data supplied was already identifiable anyway.) You have accused the authors of the report of going on a witch-hunt, but again you have offered little real argument except that such things are going on in other places, as if that makes those practices above criticism or automatically acceptable. Do you realise that you are providing a near perfect, real-time example of the need for stricter controls on medical data and who is allowed to access it?

by mtgx 10y ago

throwaway729 10y ago

> Just because you don't care to do that, doesn't mean others wouldn't do that either. More to the point, author almost certainly operated under a heavily and independently vetted IRB protocol that would have made such a purposeful re-identification a criminal or at least very serious civil offense.

aub3bhat 10y ago
True in fact the very disks that are used to distribute this data have printed warning that its misuse is a felony offense.
- throwaway729 10y ago
  So, do you believe that the sticker was appropriate? Or would a PR statement from your university's press office have been more appropriate? Ultimately, the lack of a legally binding contractual obligation with sufficient audit-ability is primarily what Julia Powles & Hal Hodson are criticizing.
  - aub3bhat 10y ago
    >> lack of legally binding From the verge article: "The data-sharing agreement — which was signed in 2015" There was a legally binding contractual agreement between the two parties Deep Mind & Royal Free. Here is the one that I and thousands (I am NOT exaggerating) of other researchers regularly sign to get access to data. https://www.hcup-us.ahrq.gov/team/NationwideDUA.jsp https://www.hcup-us.ahrq.gov/team/NationwideDUA.jsp
    - throwaway729 10y ago
      > There was a legally binding contractual agreement between the two parties Deep Mind & Royal Free. Which was, allegedly, far too lax. The claim that DeepMind was providing "direct care" is particularly questionable IMO, and that has significant implications in the context of this agreement. It means anyone who slaps together an iPhone app (and has the right clout/deep pockets) can get access to full and fully identified medical records without patient consent. IMO that's the big story here, and it's troubling. The "don't worry that's covered by existing law" responses were also problematic. Why does this particular contract need to depend upon the enforce-ability of that law? What happens if the law is repealed and DeepMind happened to keep a copy of the data? We want the protection here, in this context, so just put it in this agreement. Which is what they ultimately did in the new agreement AFAICT. Also, the data shared is extremely broad -- I doubt you could get access to a data set of that size and quality without patient consent through standard channels, for example. I've never seen an identifiable data set containing "not only to relevant blood tests and diagnostics, but historical medical records dating back five years, including information on HIV diagnoses, drug overdoses, and abortions" for 1.6 million people. Access to such sensitive data creates a difference in kind that justifies greater care and skepticism, especially WRT audit-ability. The parties appear to agree, since they signed a new agreement recently! Demonize these researchers all you want, but as a direct result of their work, NHS patients have stronger legal protections today than they did a year ago.
      - aub3bhat 10y ago
        >>> It means anyone who slaps together an iPhone app can get access to full medical records. Ummm thats how the world works, frankly its like saying water is wet. Whenever a hospital works with any third party provider, it signs a BAA agreement which governs the sharing of data. All risks of disclosure, etc. are priced into the contract. Any large hospital will have dedicated group of lawyers for sole purpose of drawing up these agreements. >> NHS patients have stronger legal protections today than they did a year ago. No they don't. For starters Deep Mind has not even returned any collected data.
        10y ago

aub3bhat 10y ago

1. UK is not in EU. The argument is that such arrangements are commonplace and I am sure one can find other such examples of data sharing in UK. 2. LOL yeah you are so damn clueless that I wont even bother replying. Lets just say there is reading some popular press article about privacy and annonymity. And then there is knowing intricate details of how business/research is conducted.

JorgeGT 10y ago
UK is in the EU until 2 years after Article 50 gets invoked, and EU data protection rules fully apply. This is a fact. The rude insult to another user, I won't even address.
- aub3bhat 10y ago
  If EU data protection rules apply then why aren't the authors marching to doors of EU Privacy Commisioner demnding to prosecute Google? The reality is that what is Deep Mind did is routine and commonplave, and that's why no one other than clickbait driven press is interested in it.
  - Silhouette 10y ago
    The ICO (the UK data protection authority) has an ongoing investigation into the deal. This is even mentioned in the original report.
  - throwaway729 10y ago
    > is routine and commonplave Then go ahead and try to get access to a similar data set. Unaudited access to fully identified and full medical records going back a half decade for 1.6 million people, without obtaining individual permission or providing any individual notice. For nothing other than the promise of some diagnostic assistance software. As a for-profit company. Good luck greasing those wheels ;-)
Silhouette 10y ago
From your comments here, it appears that you're doing PhD research dealing with large sets of healthcare data. It also appears that you are casually dismissive of concerns about the risks of that data being de-anonymised. Your best rebuttal seems to be some vague allusion that the parent poster, who was essentially correct, didn't know what they were talking about. (This is something of a digression anyway, because in the actual case we're talking about, as the report notes, the data supplied was already identifiable anyway.) You have accused the authors of the report of going on a witch-hunt, but again you have offered little real argument except that such things are going on in other places, as if that makes those practices above criticism or automatically acceptable. Do you realise that you are providing a near perfect, real-time example of the need for stricter controls on medical data and who is allowed to access it?