5 ms·

> data should be public as long as individual PII is removed This is one of those things when ideology doesn't match the real world. If the amount of data is l

> data should be public as long as individual PII is removed This is one of those things when ideology doesn't match the real world. If the amount of data is large enough and with enough parameters, removing PII doesn't do anything to protect privacy. What about medical records? What about protected classes? What about data about vulnerable people or victims? Student data is protected by another layer of regulation and for good reason. Also, the judiciary is a 'public' institution in general. Should we not seal records for minors? 'No exceptions' - year right..

godelski 3y ago
> If the amount of data is large enough and with enough parameters, removing PII doesn't do anything to protect privacy. Honestly it doesn't have to be that large. We see this all the time with data websites or apps collect. Sure, you remove John Smith's name, but you still have his GPS coordinates. For the school, you remove Professor Smith's name, but you have a professor who teaches CS 123 and has 4 graduate students. You bet you can guess who that is. I really do support open data, especially about public institutions, but at the same time we are in an era where this information is quite powerful. Seems to make a case for something like homeomorphic encryption or something, but will that even stop these collisions?
- CaptainNegative 3y ago
  The appropriate notion here seems to be Differential Privacy, which is a mathematical definition informally saying "a scrambling of the dataset that is information theoretically indistinguishable from that where one arbitrary person is added or removed". It's a surprisingly deep topic, with entire (very good!) textbooks dedicated to it. PDF (entirely legal): https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf
nradov 3y ago
We're getting a little off topic here, but the Federal government has published specific guidance on de-identification of medical records. You can construct some artificial scenarios where re-identification might be theoretically possible through record linkage with other data sources but in practice it's unlikely. In principle a similar approach could be used for student data, although I'm not familiar with the legal issues. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-... But all of this is orthogonal to the core issue of whether a state government should be allowed to prevent researchers from participating in lawsuits. There is no student privacy issue involved there. Witnesses in a civil suit still aren't allowed to violate student privacy laws regardless of the data they have access to, so it makes no sense to conflate those issues.
- dragonwriter 3y ago
  > We're getting a little off topic here, but the Federal government has published specific guidance on de-identification of medical records. But releases (even without patient consent, with an IRB waiver) of non-deidentified PHI data for research is allowed, and this is specifically because deidentification necessarily destroys elements that would often be necessary in research. > You can construct some artificial scenarios where re-identification might be theoretically possible through record linkage with other data sources but in practice it's unlikely. It is explicitly part of the HIPAA safe harbor standard that, in addition to removing the required identifiers, you cannot come up with such a scenario, and if you can, the data is not deidentified. (The last criterion of the standard is “The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information”.)
  - nradov 3y ago
    What does any of that have to do with the legal issue of whether a state should be able to prohibit participation in certain lawsuits as a condition of gaining access to research data? Neither party has raised re-identification as a concern, nor have there been any allegations of privacy law violations.
    - dragonwriter 3y ago
      > What does any of that have to do with the legal issue of whether a state should be able to prohibit participation in certain lawsuits as a condition of gaining access to research data? As you yourself noted upthread, you had already taken this subthread afield from that topic.
    - ke88y 3y ago
      I also completely lost the plot here... AFAICT, the thread went something like this: The top-level concern is something like this: professors use their trusted relationship to schools in order to make bank on expert witness fees, which feels a bit corrupt and calls into question the researcher's motives. A rebuttal to this concern is that we can side-step that issue entirely because these data sets should be public anyways (anonymized, of course!). This obviates the above concern, since the researchers won't need to compromise themselves in order to get exclusive access to data that allows them to be expert witnesses and rake in $$$$. But the problem with that proposal is re-identification: if we can't make the data anonymous, then we all agree that it shouldn't be released (implicit in the "anonymized, of course!" caveat to "just release all the data" proposal). Then you pointed out that even for more important data like healthcare data, FDA apparently has ways of allowing release of data that takes into account the risk of re-identification risk (I didn't know this; thanks for sharing!) Then dragonwriter and you got deep into the weeds on HIPPA stuff. TBH I have no idea which of you is most correct here. But anyways, there are two ways for this conversation to go: 1. You are correct, good enough anonymization is possible: Stanford researchers should not be silenced; it is problematic that they have access to data other people cannot access, but the correct solution is to negate the originally problematic distinction between those researchers and the general public by making data public. Then there is no reason for the researchers to agree to these contract clauses, because they will have access to the data. 2. dragonwriter is correct, good enough anonymization is not possible: We can go back up to the top-level concern and observe that "just release all the data with anonymization" isn't a feasible solution to this problem. Or maybe there isn't actually a problem here at all. IDK. But in any case, "obviate the problem in the top-level post by releasing anonymized data" isn't a workable solution. Again, not following closely enough to have an opinion, but that's where we are now. I think a good compromise position is that we should have a law stating that K12 data should be available to certain education researchers -- subject to IRB approval and so on -- without any other strings attached. Including "don't sue me" clauses in releases of public data sets does feel like an inappropriate abuse of student privacy concerns.
prepend 3y ago
This is true but it’s quite possible to correct for unique or infrequently occurring combinations so privacy is still preserved and data are made available. It’s not that hard to design data release to compensate for privacy protections and statistically test for a specific level of risk. There’s a whole body of work on statistical disclosure control and there’s plenty of open source or cheap enough privacy enhancing technology available. I’m not familiar with CA, but I expect they have someone on staff who can produce a “safe” dataset that preserve privacy and still allows for this question to be researched by low level geography, demographic, and socioeconomic factors.

godelski 3y ago

> If the amount of data is large enough and with enough parameters, removing PII doesn't do anything to protect privacy. Honestly it doesn't have to be that large. We see this all the time with data websites or apps collect. Sure, you remove John Smith's name, but you still have his GPS coordinates. For the school, you remove Professor Smith's name, but you have a professor who teaches CS 123 and has 4 graduate students. You bet you can guess who that is. I really do support open data, especially about public institutions, but at the same time we are in an era where this information is quite powerful. Seems to make a case for something like homeomorphic encryption or something, but will that even stop these collisions?

CaptainNegative 3y ago
The appropriate notion here seems to be Differential Privacy, which is a mathematical definition informally saying "a scrambling of the dataset that is information theoretically indistinguishable from that where one arbitrary person is added or removed". It's a surprisingly deep topic, with entire (very good!) textbooks dedicated to it. PDF (entirely legal): https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf https://www.cis.upenn.edu/~aaroth/Papers/privacybook.pdf

nradov 3y ago

We're getting a little off topic here, but the Federal government has published specific guidance on de-identification of medical records. You can construct some artificial scenarios where re-identification might be theoretically possible through record linkage with other data sources but in practice it's unlikely. In principle a similar approach could be used for student data, although I'm not familiar with the legal issues. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-... But all of this is orthogonal to the core issue of whether a state government should be allowed to prevent researchers from participating in lawsuits. There is no student privacy issue involved there. Witnesses in a civil suit still aren't allowed to violate student privacy laws regardless of the data they have access to, so it makes no sense to conflate those issues.

dragonwriter 3y ago
> We're getting a little off topic here, but the Federal government has published specific guidance on de-identification of medical records. But releases (even without patient consent, with an IRB waiver) of non-deidentified PHI data for research is allowed, and this is specifically because deidentification necessarily destroys elements that would often be necessary in research. > You can construct some artificial scenarios where re-identification might be theoretically possible through record linkage with other data sources but in practice it's unlikely. It is explicitly part of the HIPAA safe harbor standard that, in addition to removing the required identifiers, you cannot come up with such a scenario, and if you can, the data is not deidentified. (The last criterion of the standard is “The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information”.)
- nradov 3y ago
  What does any of that have to do with the legal issue of whether a state should be able to prohibit participation in certain lawsuits as a condition of gaining access to research data? Neither party has raised re-identification as a concern, nor have there been any allegations of privacy law violations.
  - dragonwriter 3y ago
    > What does any of that have to do with the legal issue of whether a state should be able to prohibit participation in certain lawsuits as a condition of gaining access to research data? As you yourself noted upthread, you had already taken this subthread afield from that topic.
  - ke88y 3y ago
    I also completely lost the plot here... AFAICT, the thread went something like this: The top-level concern is something like this: professors use their trusted relationship to schools in order to make bank on expert witness fees, which feels a bit corrupt and calls into question the researcher's motives. A rebuttal to this concern is that we can side-step that issue entirely because these data sets should be public anyways (anonymized, of course!). This obviates the above concern, since the researchers won't need to compromise themselves in order to get exclusive access to data that allows them to be expert witnesses and rake in $$$$. But the problem with that proposal is re-identification: if we can't make the data anonymous, then we all agree that it shouldn't be released (implicit in the "anonymized, of course!" caveat to "just release all the data" proposal). Then you pointed out that even for more important data like healthcare data, FDA apparently has ways of allowing release of data that takes into account the risk of re-identification risk (I didn't know this; thanks for sharing!) Then dragonwriter and you got deep into the weeds on HIPPA stuff. TBH I have no idea which of you is most correct here. But anyways, there are two ways for this conversation to go: 1. You are correct, good enough anonymization is possible: Stanford researchers should not be silenced; it is problematic that they have access to data other people cannot access, but the correct solution is to negate the originally problematic distinction between those researchers and the general public by making data public. Then there is no reason for the researchers to agree to these contract clauses, because they will have access to the data. 2. dragonwriter is correct, good enough anonymization is not possible: We can go back up to the top-level concern and observe that "just release all the data with anonymization" isn't a feasible solution to this problem. Or maybe there isn't actually a problem here at all. IDK. But in any case, "obviate the problem in the top-level post by releasing anonymized data" isn't a workable solution. Again, not following closely enough to have an opinion, but that's where we are now. I think a good compromise position is that we should have a law stating that K12 data should be available to certain education researchers -- subject to IRB approval and so on -- without any other strings attached. Including "don't sue me" clauses in releases of public data sets does feel like an inappropriate abuse of student privacy concerns.

prepend 3y ago

This is true but it’s quite possible to correct for unique or infrequently occurring combinations so privacy is still preserved and data are made available. It’s not that hard to design data release to compensate for privacy protections and statistically test for a specific level of risk. There’s a whole body of work on statistical disclosure control and there’s plenty of open source or cheap enough privacy enhancing technology available. I’m not familiar with CA, but I expect they have someone on staff who can produce a “safe” dataset that preserve privacy and still allows for this question to be researched by low level geography, demographic, and socioeconomic factors.