Abstract:Background: Sharing data from clinical studies can accelerate scientific progress, improve transparency, and increase the potential for innovation and collaboration. However, privacy concerns remain a barrier to data sharing. Certain concerns, such as reidentification risk, can be addressed through the application of anonymization algorithms, whereby data are altered so that it is no longer reasonably related to a person. Yet, such alterations have the potential to influence the data set's statistical properties, such that the privacy-utility trade-off must be considered. This has been studied in theory, but evidence based on real-world individual-level clinical data is rare, and anonymization has not broadly been adopted in clinical practice. Objective: The goal of this study is to contribute to a better understanding of anonymization in the real world by comprehensively evaluating the privacy-utility trade-off of differently anonymized data using data and scientific results from the German Chronic Kidney Disease (GCKD) study. Methods: The GCKD data set extracted for this study consists of 5217 records and 70 variables. A 2-step procedure was followed to determine which variables constituted reidentification risks. To capture a large portion of the risk-utility space, we decided on risk thresholds ranging from 0.02 to 1. The data were then transformed via generalization and suppression, and the anonymization process was varied using a generic and a use case–specific configuration. To assess the utility of the anonymized GCKD data, general-purpose metrics (ie, data granularity and entropy), as well as use case–specific metrics (ie, reproducibility), were applied. Reproducibility was assessed by measuring the overlap of the 95% CI lengths between anonymized and original results. Results: Reproducibility measured by 95% CI overlap was higher than utility obtained from general-purpose metrics. For example, granularity varied between 68.2% and 87.6%, and entropy varied between 25.5% and 46.2%, whereas the average 95% CI overlap was above 90% for all risk thresholds applied. A nonoverlapping 95% CI was detected in 6 estimates across all analyses, but the overwhelming majority of estimates exhibited an overlap over 50%. The use case–specific configuration outperformed the generic one in terms of actual utility (ie, reproducibility) at the same level of privacy. Conclusions: Our results illustrate the challenges that anonymization faces when aiming to support multiple likely and possibly competing uses, while use case–specific anonymization can provide greater utility. This aspect should be taken into account when evaluating the associated costs of anonymized data and attempting to maintain sufficiently high levels of privacy for anonymized data. Trial Registration: German Clinical Trials Register DRKS00003971; https://drks.de/search/en/trial/DRKS00003971

Ensuring anonymity in survey panel research

A survey on UK researchers' views regarding their experiences with the de-identification, anonymisation, release methods and re-identification risk estimation for clinical trial datasets

Assessing the risk of re-identification arising from an attack on anonymised data

How to Avoid Reidentification with Proper Anonymization

A Decision Tree Approach for Assessing and Mitigating Background and Identity Disclosure Risks.

Anonymity-preserving data collection.

Evaluating the re-identification risk of a clinical study report anonymized under EMA Policy 0070 and Health Canada Regulations

Anonymising Clinical Data for Secondary Use

The Costs of Anonymization: Case Study Using Clinical Data

K-Anonymity for Crowdsourcing Database

Balancing Inferential Integrity and Disclosure Risk via Model Targeted Masking and Multiple Imputation

Post-randomization for Controlling Identification Risk in Releasing Microdata from General Surveys

Privacy Risk Assessment for Synthetic Longitudinal Health Data

k-Anonymous data collection

Evaluating the disclosure risk of anonymized documents via a machine learning-based re-identification attack

Privacy Vulnerabilities of Dataset Anonymization Techniques

Health Data Re-Identification: Assessing Adversaries and Potential Harms

Releasing survey microdata with exact cluster locations and additional privacy safeguards

Evaluating privacy of individuals in medical data

A Novel Microdata Privacy Disclosure Risk Measure

A Summary of Privacy-Preserving Data Publishing in the Local Setting