Open tools for quantitative anonymization of tabular phenotype data: literature review

Abstract

Precision medicine relies on molecular and systems biology methods as well as bidirectional association studies of phenotypes and (high-throughput) genomic data. However, the integrated use of such data often faces obstacles, especially in regards to data protection. An important prerequisite for research data processing is usually informed consent. But collecting consent is not always feasible, in particular when data are to be analyzed retrospectively. For phenotype data, anonymization, i.e. the altering of data in such a way that individuals cannot be identified, can provide an alternative. Several re-identification attacks have shown that this is a complex task and that simply removing directly identifying attributes such as names is usually not enough. More formal approaches are needed that use mathematical models to quantify risks and guide their reduction. Due to the complexity of these techniques, it is challenging and not advisable to implement them from scratch. Open software libraries and tools can provide a robust alternative. However, also the range of available anonymization tools is heterogeneous and obtaining an overview of their strengths and weaknesses is difficult due to the complexity of the problem space. We therefore performed a systematic review of open anonymization tools for structured phenotype data described in the literature between 1990 and 2021. Through a two-step eligibility assessment process, we selected 13 tools for an in-depth analysis. By comparing the supported anonymization techniques and further aspects, such as maturity, we derive recommendations for tools to use for anonymizing phenotype datasets with different properties.

The Costs of Anonymization: Case Study Using Clinical Data

“…While an increasing number of examples of real-world applications of anonymization algorithms are published [ 12 , 15 , 16 ], we did not come across any investigations that measured the reproducibility (eg, by 95% CI overlap) of descriptive real-world analyses except for prior work on the GCKD study. However, several studies focusing on preserving the utility of anonymized data for descriptive real-world analyses without explicitly introducing use case–specific measures have been published.…”

“…Anonymization can be performed using various transformation mechanisms, such as suppression, randomization, or generalization. Software-enabled solutions have been developed with implementations of published algorithms to support this process [ 12 ]. Yet, there is an inherent trade-off between the reduction of privacy risks and the utility of the data that can be shared [ 13 ].…”

“…This challenge has been studied extensively in theory [ 14 ], and the evidence for utility-preserving anonymization is growing [ 12 , 15 - 18 ]. However, anonymization has not been broadly adopted in clinical practice.…”

Using preregistration as a tool for transparent fNIRS study design

“…Furthermore, one should reduce the amount of detail when it comes to meta data. 205 For example, instead of reporting a table with the exact ages of participants, a range can be reported instead. Finally, many departments and universities employ data stewards or data protection managers that can advise researchers on how to comply with local and national data sharing policies and implement FAIR data sharing principles.…”

“…We further recommend avoiding sharing data that is not essential for the research question or follow-up analyses but has a high disclosure risk (e.g., an unusual finding). Furthermore, one should reduce the amount of detail when it comes to meta data 205 . For example, instead of reporting a table with the exact ages of participants, a range can be reported instead.…”