Working toward effective anonymization for surveillance data: innovation at South Africa’s Agincourt Health and Socio-Demographic Surveillance Site

Abstract

Linking people and places is essential for population-health-environment research. Yet, this data integration requires geographic coding such that information reflecting individuals or households can appropriately be connected with characteristics of their proximate environments. However, offering access to such geocoding greatly increases the risk of respondent identification and, therefore, holds the potential to breach confidentiality. In response, a variety of "geographic masking" techniques have been developed to introduce error into geographic coding and thereby reduce the likelihood of identification. We report findings from analyses of the error introduced by several masking techniques applied to data from the Agincourt Health and Socio-Demographic Surveillance System in rural South Africa. Using a vegetation index (Normalized Difference Vegetation Index (NDVI)) at the household scale, comparisons are made between the "true" NDVI values and those calculated after masking. We also examine the tradeoffs between accuracy and protecting respondent privacy. The exploration suggests that in this study setting and for NDVI, geomasking approaches that use buffers and account for population density produce the most accurate results. However, the exploration also clearly demonstrates the tradeoff between accuracy and privacy, with more accuracy resulting in a higher level of potential respondent identification. It is important to note that these analyses illustrate a process that should characterize spatially informed research but within which particular decisions must be shaped by the research setting and objectives. In the long run, we aim to provide insight into masking's potential and perils to facilitate population-environment-health research.

Population responses to environmental change: looking back, looking forward

“…In the DHS, for example, sample clusters are randomly displaced up to 2 km in urban areas and up to 5 km in rural areas, with a further displacement up to 10 km for a random 1% of the latter (Burgert et al, 2013). Although geographic masking may affect the specific values of measures such as the Normalized Difference Vegetation Index (NDVI), the extent to which analytic results are affected by this displacement is an open question, and one pursued in this special issue (Hunter et al, 2021). More work is needed to understand the consequences of this deliberately induced error, and indeed, the consequences of the full range of strategies that have been implemented to protect data confidentiality.…”

Releasing survey microdata with exact cluster locations and additional privacy safeguards

“…However, it does not provide a similar rigorous measure for privacy protection as already small sets of attributes can quickly increase the chances of re-identification, even in incomplete, pseudonymous datasets [23]. In addition, it obviously affects the utility of the published data when it comes to matching with auxiliary data as this type of analysis relies on the congruence of its geographic links [24,25,26,27].…”