[MyData & Open Data] [globalpriv-discussion] Catalonia to sell "anonymised" medical records

Thu Apr 2 11:46:24 UTC 2015

Dear Gemma,

This is deeply concerning. I’m afraid I don’t read Catalan/Spanish so I have only been able to read the articles via Google Translate. 

Please could you clarify a few things:

1) If I understand correctly, the government’s plan boils down to identifiable patient data being passed to a commercial entity, as yet undetermined, where it will be pseudonymised in some way and then sold on to third parties.

·         Do patients have a right to opt out?

·         If so, how are they to be informed and how do they exercise it?

·         How will the company that will be receiving the population’s identifiable medical records be chosen? Who owns it, etc. etc.? (I’m not clear on the difference between ICS, AQuAS, etc. – though that may not be relevant.)

·         Which third parties will be able to buy data? Who will approve them, and how?

·         Will the (pseudonymised)data itself be passed to the third parties or will they only have access to it, e.g. via a ‘safe setting’?

·         What independent oversight mechanisms, audit and transparency processes are in place?

2) Is the proposal to sell data that has been pseudonymised merely by means of hashing one (or more) identifiers, i.e. they are doing nothing about quasi-identifiers, and are ignoring all the evidence on re-identification of linked individual-level data?

medConfidential has found it helpful to frame secondary uses of patient data in terms of “consensual, safe and transparent”. >From what I’ve read so far, the Catalan government’s plans meet none of these criteria.

Please feel free to contact me direct or give me a call on +44 7974 230 839, if it would be helpful to chat.

Kind regards,

Phil

From: pi-discussion-bounces at privacyinternational.org [mailto:pi-discussion-bounces at privacyinternational.org] On Behalf Of Gemma Galdon Clavell
Sent: 02 April 2015 11:16
To: Javier Ruiz
Cc: Discussion list on Data Anonymisation; pi-discussion at privacyinternational.org; <SURVEILLANCE at jiscmail.ac.uk>; mydata-open-data
Subject: Re: [globalpriv-discussion] Catalonia to sell "anonymised" medical records

Dear all,

As you can see below, the Catalan government has agree to sell medical records. A PIA was conducted by the regional DPA and there should be a CPO, but the initiative has been launched despite the opposition from Parliament and info on the implementation of the PIA recommendations is not available.

I raised some of the issues in El País last year http://ccaa.elpais.com/ccaa/2014/10/24/catalunya/1414172573_550596.html, and this led the Parliament to position itself against the initiative. But the government has decided to move ahead anyway.

Any 'noise' you can make about this issue will be greatly appreciated. While I think that Big Data carries a lot of potential in the field of heath, without robust pseudonimity (hashing is clearly not enough), transparency and guarantees this is and extremely irresponsible move.

Kind regards,

Gemma G. Clavell, PhD

Eticas Research & Consulting

C/ Ferlandina 49 (08001 Barcelona) / Reloj 2 (28770 Madrid)

+34 936 005 400 - www.eticasconsulting.com - @eticasconsult

  <http://www.eticasconsulting.es/wp-content/uploads/logoReticaseng.png> 

On Thu, Apr 2, 2015 at 12:07 PM, Javier Ruiz <javier at openrightsgroup.org> wrote:

HI, sorry it is only in Spanish.

Catalonian authorities agree to sell medical records to researchers despite a vote by the regional Parliament to stop the project. 

http://politica.elpais.com/politica/2015/04/01/actualidad/1427892067_062214.html

Catalonian data protection authorities and academics had raised concerns about anonymisation in the context of big data.

http://ccaa.elpais.com/ccaa/2014/11/01/catalunya/1414870966_992102.html

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.okfn.org/pipermail/mydata-open-data/attachments/20150402/c96511af/attachment-0002.html>