Privacy Risks of Sharing Data from Environmental Health Studies

Abstract

BACKGROUND: Sharing research data uses resources effectively; enables large, diverse data sets; and supports rigor and reproducibility. However, sharing such data increases privacy risks for participants who may be re-identified by linking study data to outside data sets. These risks have been investigated for genetic and medical records but rarely for environmental data. OBJECTIVES: We evaluated how data in environmental health (EH) studies may be vulnerable to linkage and we investigated, in a case study, whether environmental measurements could contribute to inferring latent categories (e.g., geographic location), which increases privacy risks. METHODS: We identified 12 prominent EH studies, reviewed the data types collected, and evaluated the availability of outside data sets that overlap with study data. With data from the Household Exposure Study in California and Massachusetts and the Green Housing Study in Boston, Massachusetts, and Cincinnati, Ohio, we used k-means clustering and principal component analysis to investigate whether participants' region of residence could be inferred from measurements of chemicals in household air and dust. RESULTS: All 12 studies included at least two of five data types that overlap with outside data sets: geographic location (9 studies), medical data (9 studies), occupation (10 studies), housing characteristics (10 studies), and genetic data (7 studies). In our cluster analysis, participants' region of residence could be inferred with 80%-98% accuracy using environmental measurements with original laboratory reporting limits. DISCUSSION: EH studies frequently include data that are vulnerable to linkage with voter lists, tax and real estate data, professional licensing lists, and ancestry websites, and exposure measurements may be used to identify subgroup membership, increasing likelihood of linkage. Thus, unsupervised sharing of EH research data potentially raises substantial privacy risks. Empirical research can help characterize risks and evaluate technical solutions. Our findings reinforce the need for legal and policy protections to shield participants from potential harms of re-identification from data sharing.

PeQES: A Platform for Privacy-enhanced Quantitative Empirical Studies

“…We have implemented PeQES using the Rust-based Fortanix Enclave Development Platform 3 . The prototype implementation of the PeQES platform is available under an open source license 4 .…”

“…This practice is sometimes complemented with the publication of primary data sets to verify analyses and to foster reuse [13]. This practice yields new privacy issues [3], though (e.g., de-anonymization and re-identification attacks against study participants).…”

Perspective: The Power (Dynamics) of Open Data in Citizen Science

“…Additionally, in conjunction with existing data sets such as tax and real estate data or voter lists, new volunteer-collected data sets may enable re-identification of individuals or their locations via data triangulation (Golle, 2006). Even when researchers anonymize environmental health data by removing overt identifiers such as names and addresses, risks to re-identification of participants remain (Boronow et al, 2020).…”

Emerging Privacy Issues in Times of Open Science

“…Researchers have shown that robust de-anonymization is possible in many domains, such as social networks (Narayanan, Shi, & Rubinstein, 2011;Narayanan & Shmatikov, 2009), participants in social media studies (Ayers, Caputi, Nebeker, & Dredze, 2018), genetic data (Craig, 2016;Ellenbogen & Narayanan, 2019;Erlich, Shor, Peer, & Carmi, 2018;Gymrek, McGuire, Golan, Halperin, & Erlich, 2013;Homer et al, 2008), environmental health studies (Boronow et al, 2020), location data (De Montjoye, Hidalgo, Verleysen, & Blondel, 2013Golle & Partridge, 2009;Zang & Bolot, 2011), browsing histories (Su, Shukla, Goel, & Narayanan, 2017), and even writing style (Narayanan et al, 2012). The key finding of all this research, including theoretical evidence (Datta, Sharma, & Sinha, 2012), is that high-dimensional data is inherently vulnerable to deanonymization.…”