3 ms·

Concerns about de-anonymization are NOT AT ALL relevant in cases where patient level data is shared. Since its common knowledge that this data is ripe for misus

Concerns about de-anonymization are NOT AT ALL relevant in cases where patient level data is shared. Since its common knowledge that this data is ripe for misuse and abuse. As a result government agencies have developed a set of legal requirements and contracts to be used when sharing such data. Talking about differential-privacy and de-identification-is-not-de-anonymization is meaningless in this context since all parties are acutely aware of the potential for misuse of this data. And regarding your concern about me, if anything I should be the one engaging in this ridiculous witch hunt against Deep Mind since I have during my PhD developed an Open Source transparent analytics platform for data on millions of patients. But unlike the authors I want real debate and real systems that can be used, not faux outrage over another click bait article. http://www.computationalhealthcare.com http://www.computationalhealthcare.com

Silhouette 10y ago
As a result government agencies have developed a set of legal requirements and contracts to be used when sharing such data. That still doesn't matter. If Royal Free shared personal health data with Deep Mind without the data subjects' explicit consent, and if the arrangement doesn't fall under other permitted conditions for processing sensitive personal data under the DPA, then someone is breaking the law. If there were not at least some legitimate grounds for concern about whether that is the case, it is unlikely that the ICO would have opened a formal investigation into the deal. Again, nothing written in any contract between the organisations involved supersedes our primary data protection legislation. As for standard processes for handling such situations developed by government agencies, another substantial part of the report was about how the various regulatory bodies do not seem to have been consulted in ways that would normally have been expected before starting a project of this nature. There is nothing routine, in the UK environment, about transferring complete, multi-year medical records for large numbers of identifiable individuals to external organisations not run by medical professionals for such open-ended purposes as those described in the agreement here. This is not a small thing.
throwaway729 10y ago
> But unlike the authors I want real debate Substantively improving patient privacy protections in a concrete case by forcing a large corporation to agree to strong privacy protections and auditing regimes seems like a "real" contribution spurring a "real" debate. For 1.6 million people, the results stemming from this paper much more "real" than any number of git commits to a software system.
- aub3bhat 10y ago
  Number of git commits!!! hahhahah. Chill dude, chill. Software changes the world.
  - throwaway729 10y ago
    > Number of git commits!!! Well, it's true. Differential privacy is a nice idea, but in this particular case, you're disparaging a style of research that -- to date -- has had a much greater impact on improving actual, real world privacy than all the fanciest query engines in the world. > Software changes the world. The most important thing to know about differential privacy is that when in comes to privacy, software always plays second fiddle to policy and politics. Differential privacy algorithms are literally nothing other than the implementation of a legal spec. Without the law, the algorithms are pointless. Mind you, I don't intend to disparage differential privacy work in any way! But disparaging policy research while holding up differential privacy systems as the answer massively misses the point...
    - aub3bhat 10y ago
      LOL I actually don't use differential privacy at all! My software implements legal requirements as stated by the agency providing the data. Which are equivalent to a stronger version of K-Anonymity. I am not at all against Policy Research, the issue is that this particular paper is a spectacularly BAD example of Policy Research. Policy research should not be driven by FUD around AI (e.g. the quote "did not constrain the company from using AI analytical techniques on the data") or some corporation.
dragonwriter 10y ago
> And regarding your concern about me, if anything I should be the one engaging in this ridiculous witch hunt against Deep Mind I dunno; if your cavalier attitude toward privacy protections around personal health data reflect how your research was managed, there could be a very strong personal-interest reason for you to be waving around the "no big deal" flag you are waving about DeepMind.
- aub3bhat 10y ago
  Or maybe maybe I have deeper knowledge of intricacies & current state of healthcare data. Even the expert from Wellcome Trust thinks its “overly-critical”.
  - Silhouette 10y ago
    Surely you aren't claiming deeper knowledge of UK data protection law and UK best practices regarding processing health-related data than everyone else here? You have demonstrated a lack of familiarity with the general UK/EU regime around privacy and data protection. You were either unaware that the ICO was formally investigating the deal we're talking about or misunderstood the significance of that. You seem to be assuming that everyone else is as liberal with sharing personal data as the US regime, but if anything it's probably the US regime that is the outlier, and it's not something many of us think we should emulate.
halhodson 10y ago
"But unlike the authors I want real debate" Hello. I am one of the authors. We are on the record saying that we want a real debate. See: http://uk.businessinsider.com/deepmind-royal-free-london-nhs-deal-inexcusable-mistakes-2017-3 http://uk.businessinsider.com/deepmind-royal-free-london-nhs... https://www.theregister.co.uk/2017/03/16/googles_deepmind_and_royal_free_hospital_deal_inexcusable/ https://www.theregister.co.uk/2017/03/16/googles_deepmind_an... http://www.bbc.co.uk/news/technology-39301901 http://www.bbc.co.uk/news/technology-39301901

Silhouette 10y ago

As a result government agencies have developed a set of legal requirements and contracts to be used when sharing such data. That still doesn't matter. If Royal Free shared personal health data with Deep Mind without the data subjects' explicit consent, and if the arrangement doesn't fall under other permitted conditions for processing sensitive personal data under the DPA, then someone is breaking the law. If there were not at least some legitimate grounds for concern about whether that is the case, it is unlikely that the ICO would have opened a formal investigation into the deal. Again, nothing written in any contract between the organisations involved supersedes our primary data protection legislation. As for standard processes for handling such situations developed by government agencies, another substantial part of the report was about how the various regulatory bodies do not seem to have been consulted in ways that would normally have been expected before starting a project of this nature. There is nothing routine, in the UK environment, about transferring complete, multi-year medical records for large numbers of identifiable individuals to external organisations not run by medical professionals for such open-ended purposes as those described in the agreement here. This is not a small thing.

throwaway729 10y ago

> But unlike the authors I want real debate Substantively improving patient privacy protections in a concrete case by forcing a large corporation to agree to strong privacy protections and auditing regimes seems like a "real" contribution spurring a "real" debate. For 1.6 million people, the results stemming from this paper much more "real" than any number of git commits to a software system.

aub3bhat 10y ago
Number of git commits!!! hahhahah. Chill dude, chill. Software changes the world.
- throwaway729 10y ago
  > Number of git commits!!! Well, it's true. Differential privacy is a nice idea, but in this particular case, you're disparaging a style of research that -- to date -- has had a much greater impact on improving actual, real world privacy than all the fanciest query engines in the world. > Software changes the world. The most important thing to know about differential privacy is that when in comes to privacy, software always plays second fiddle to policy and politics. Differential privacy algorithms are literally nothing other than the implementation of a legal spec. Without the law, the algorithms are pointless. Mind you, I don't intend to disparage differential privacy work in any way! But disparaging policy research while holding up differential privacy systems as the answer massively misses the point...
  - aub3bhat 10y ago
    LOL I actually don't use differential privacy at all! My software implements legal requirements as stated by the agency providing the data. Which are equivalent to a stronger version of K-Anonymity. I am not at all against Policy Research, the issue is that this particular paper is a spectacularly BAD example of Policy Research. Policy research should not be driven by FUD around AI (e.g. the quote "did not constrain the company from using AI analytical techniques on the data") or some corporation.

dragonwriter 10y ago

> And regarding your concern about me, if anything I should be the one engaging in this ridiculous witch hunt against Deep Mind I dunno; if your cavalier attitude toward privacy protections around personal health data reflect how your research was managed, there could be a very strong personal-interest reason for you to be waving around the "no big deal" flag you are waving about DeepMind.

aub3bhat 10y ago
Or maybe maybe I have deeper knowledge of intricacies & current state of healthcare data. Even the expert from Wellcome Trust thinks its “overly-critical”.
- Silhouette 10y ago
  Surely you aren't claiming deeper knowledge of UK data protection law and UK best practices regarding processing health-related data than everyone else here? You have demonstrated a lack of familiarity with the general UK/EU regime around privacy and data protection. You were either unaware that the ICO was formally investigating the deal we're talking about or misunderstood the significance of that. You seem to be assuming that everyone else is as liberal with sharing personal data as the US regime, but if anything it's probably the US regime that is the outlier, and it's not something many of us think we should emulate.

halhodson 10y ago

"But unlike the authors I want real debate" Hello. I am one of the authors. We are on the record saying that we want a real debate. See: http://uk.businessinsider.com/deepmind-royal-free-london-nhs-deal-inexcusable-mistakes-2017-3 http://uk.businessinsider.com/deepmind-royal-free-london-nhs... https://www.theregister.co.uk/2017/03/16/googles_deepmind_and_royal_free_hospital_deal_inexcusable/ https://www.theregister.co.uk/2017/03/16/googles_deepmind_an... http://www.bbc.co.uk/news/technology-39301901 http://www.bbc.co.uk/news/technology-39301901