3 ms·

Sounds perhaps a bit naive, as one might expect from German government, when it comes to data. How much of such data does one need to de-anonymize someone? How

Sounds perhaps a bit naive, as one might expect from German government, when it comes to data. How much of such data does one need to de-anonymize someone? How easy will it be to accidentally slip identifying data in using whatever kind of system, that is supposed to be used? How easy will it be for any company like MS to correlate that data with all that other data they extracted without user consent?

lb4r 3y ago
>How easy will it be for any company like MS to correlate that data with all that other data they extracted without user consent? Doable to some extent, but would they really learn much that we haven't already told them, given our propensity to Google for symptoms and diseases? Personally, my worry here, if I had some embarrassing medical history that I wouldn't want people to know about, would be some malicious party gaining access to de-anonymized data and using it to blackmail, or just simply making it public. Edit: Come to think of it, insurance companies could probably have a field day with a data set like this.
- LadyCailin 3y ago
  The civilized world has universal health coverage, so the insurance thing isn’t really a problem except in one particular country. But the malicious release is definitely a problem.
  - fileeditview 3y ago
    It never is a problem until it is. Insurance companies in Germany are also not benevolent. If there is a case where they do not have to pay they won't. If they can use data to save money they will do it, even if it worsens your conditions.
    - snowpid 3y ago
      " Insurance companies in Germany are also not benevolent. " You know, that the leaders of public insuarances are voted by the customers.
      - angra_mainyu 3y ago
        One might argue that the free market is consumer-driven voting.
      - wirrbel 3y ago
        Not all public insurances perform these elections but some, e.g. Barmer GEK, Techniker Krankenkasse, DAK-Gesundheit, Kaufmännische Krankenkasse – KKH, Handelskrankenkasse und BKK RWE and I think also AOK.
    - ahartmetz 3y ago
      It doesn't feel adversarial as a customer. Never did for me, never heard it from others. They aren't even regular companies - they have a special legal status. Private insurance, which is also available, is different.
  - angra_mainyu 3y ago
    Blatantly false. I've been in Europe two decades and aside from health insurance being key to more than a few countries, private health insurance is relatively common in tandem with public health services.
    - wirrbel 3y ago
      Quite typically there is basic service via a welfare system and additional or premium service with insurances. I pay into the public health system at a rate proportional to my income (which is more than what I would pay if I had a worse-paying job for the same service), and I have an additional dental insurance which insures my teeth.
      - angra_mainyu 3y ago
        No, I mean full-blown private health insurance. In France, Belgium and Netherlands it's very common (and I think mandatory in NL). Outside of those countries, it's still somewhat common to have private health insurance (not just dental), such as Mapfre or Regina Maria. Heck, even in Germany something like 1 out of 10 people have private health insurance (again, not just dental).
  - tgsovlerkhgsel 3y ago
    The "civilized world" does not, however, have universal life insurance nor disability insurance that would cover the full standard of living. Those are, at least in Germany, privatized, and companies could benefit a lot from having access to some extra data. I'm not sure that getting caught using such data would be sufficiently bad news to be not worth it.
  - graemep 3y ago
    No, because medial data can also be used for things like life insurance, insurance against loss of earnings caused by sickness, and probably a lot of other things.
V__ 3y ago
The companies and researchers get access to the data with oversight but the data isn't shared. They basically get access to a server to run their analysis but can't retrieve the data.
- chopin 3y ago
  There is almost zero retribution for non-compliance. This law is ripe for abuse. It's only a question when, not if, the data will become public. Conveniently, people with private insurance are exempted, which are most of our politicians and all of our public servants.
  - V__ 3y ago
    Wrong. Potential fines for a GDPR breach, under which this could fall under, are 4% of the firm's worldwide annual revenue from the preceding financial year. But there is also a criminal code in the works for violating data provided by this bill.
belter 3y ago
Incredibly naive. Easy to de-anonymize. First they come for the books, now AI practitioners come for the health data. "Estimating the success of re-identifications in incomplete datasets using generative models" - https://www.nature.com/articles/s41467-019-10933-3 https://www.nature.com/articles/s41467-019-10933-3 "...We here propose a generative copula-based method that can accurately estimate the likelihood of a specific person to be correctly re-identified, even in a heavily incomplete dataset. On 210 populations, our method obtains AUC scores for predicting individual uniqueness ranging from 0.84 to 0.97, with low false-discovery rate. Using our model, we find that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes. Our results suggest that even heavily sampled anonymized datasets are unlikely to satisfy the modern standards for anonymization ..."
- awesomeMilou 3y ago
  A similar paper, ~3k citations, on deanonymization in sparse datasets: https://systems.cs.columbia.edu/private-systems-class/papers/Narayanan2008Robust.pdf https://systems.cs.columbia.edu/private-systems-class/papers... It's well known within the sphere that anonymization is hard and deanonymization is trivial. The original Netflix prize around their recommender system also had issues with deanonymization.
awesomeMilou 3y ago
It is important to note the the original draft for the law does not talk about anonymizing data, but rather pseudonymizing of data. So no attemt is made at keeping identities of patients truly anonymous (which has been repeadeatly proven to be impossible in sparse datasets).

lb4r 3y ago

>How easy will it be for any company like MS to correlate that data with all that other data they extracted without user consent? Doable to some extent, but would they really learn much that we haven't already told them, given our propensity to Google for symptoms and diseases? Personally, my worry here, if I had some embarrassing medical history that I wouldn't want people to know about, would be some malicious party gaining access to de-anonymized data and using it to blackmail, or just simply making it public. Edit: Come to think of it, insurance companies could probably have a field day with a data set like this.

LadyCailin 3y ago
The civilized world has universal health coverage, so the insurance thing isn’t really a problem except in one particular country. But the malicious release is definitely a problem.
- fileeditview 3y ago
  It never is a problem until it is. Insurance companies in Germany are also not benevolent. If there is a case where they do not have to pay they won't. If they can use data to save money they will do it, even if it worsens your conditions.
  - snowpid 3y ago
    " Insurance companies in Germany are also not benevolent. " You know, that the leaders of public insuarances are voted by the customers.
    - angra_mainyu 3y ago
      One might argue that the free market is consumer-driven voting.
    - wirrbel 3y ago
      Not all public insurances perform these elections but some, e.g. Barmer GEK, Techniker Krankenkasse, DAK-Gesundheit, Kaufmännische Krankenkasse – KKH, Handelskrankenkasse und BKK RWE and I think also AOK.
  - ahartmetz 3y ago
    It doesn't feel adversarial as a customer. Never did for me, never heard it from others. They aren't even regular companies - they have a special legal status. Private insurance, which is also available, is different.
- angra_mainyu 3y ago
  Blatantly false. I've been in Europe two decades and aside from health insurance being key to more than a few countries, private health insurance is relatively common in tandem with public health services.
  - wirrbel 3y ago
    Quite typically there is basic service via a welfare system and additional or premium service with insurances. I pay into the public health system at a rate proportional to my income (which is more than what I would pay if I had a worse-paying job for the same service), and I have an additional dental insurance which insures my teeth.
    - angra_mainyu 3y ago
      No, I mean full-blown private health insurance. In France, Belgium and Netherlands it's very common (and I think mandatory in NL). Outside of those countries, it's still somewhat common to have private health insurance (not just dental), such as Mapfre or Regina Maria. Heck, even in Germany something like 1 out of 10 people have private health insurance (again, not just dental).
- tgsovlerkhgsel 3y ago
  The "civilized world" does not, however, have universal life insurance nor disability insurance that would cover the full standard of living. Those are, at least in Germany, privatized, and companies could benefit a lot from having access to some extra data. I'm not sure that getting caught using such data would be sufficiently bad news to be not worth it.
- graemep 3y ago
  No, because medial data can also be used for things like life insurance, insurance against loss of earnings caused by sickness, and probably a lot of other things.

V__ 3y ago

The companies and researchers get access to the data with oversight but the data isn't shared. They basically get access to a server to run their analysis but can't retrieve the data.

chopin 3y ago
There is almost zero retribution for non-compliance. This law is ripe for abuse. It's only a question when, not if, the data will become public. Conveniently, people with private insurance are exempted, which are most of our politicians and all of our public servants.
- V__ 3y ago
  Wrong. Potential fines for a GDPR breach, under which this could fall under, are 4% of the firm's worldwide annual revenue from the preceding financial year. But there is also a criminal code in the works for violating data provided by this bill.

belter 3y ago

Incredibly naive. Easy to de-anonymize. First they come for the books, now AI practitioners come for the health data. "Estimating the success of re-identifications in incomplete datasets using generative models" - https://www.nature.com/articles/s41467-019-10933-3 https://www.nature.com/articles/s41467-019-10933-3 "...We here propose a generative copula-based method that can accurately estimate the likelihood of a specific person to be correctly re-identified, even in a heavily incomplete dataset. On 210 populations, our method obtains AUC scores for predicting individual uniqueness ranging from 0.84 to 0.97, with low false-discovery rate. Using our model, we find that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes. Our results suggest that even heavily sampled anonymized datasets are unlikely to satisfy the modern standards for anonymization ..."

awesomeMilou 3y ago
A similar paper, ~3k citations, on deanonymization in sparse datasets: https://systems.cs.columbia.edu/private-systems-class/papers/Narayanan2008Robust.pdf https://systems.cs.columbia.edu/private-systems-class/papers... It's well known within the sphere that anonymization is hard and deanonymization is trivial. The original Netflix prize around their recommender system also had issues with deanonymization.

awesomeMilou 3y ago

It is important to note the the original draft for the law does not talk about anonymizing data, but rather pseudonymizing of data. So no attemt is made at keeping identities of patients truly anonymous (which has been repeadeatly proven to be impossible in sparse datasets).