[MyData & Open Data] [globalpriv-discussion] Catalonia to sell "anonymised" medical records

Thu Apr 2 13:48:39 UTC 2015

Hi Gemma, Phil, Judith and all,

In Canada, we are currently trying to assess a recently issued report
that tries to set the roadmap for centralization + expanded access to
health data (for now it's limited to research purposes). It too relies
heavily on 'anonymization', but it's going to be 'tempered' hashing
because they want social contextual factors like postal code,
nationality, maybe even familial info, etc., depending on the research
context. No opt out/in needed, since we have risk mitigation via
'anonymization'.

The report (which we anticipate to be very influential unless countered)
is here:
http://www.scienceadvice.ca/uploads/eng/assessments%20and%20publications%20and%20news%20releases/Health-data/HealthDataFullReportEn.pdf

I'm wondering if anyone is aware of any gold standard (from a civil
society perspective) road maps on implementing this kind of thing? This
report points to scotland/wales as a model to be emulated.

Best,
Tamir

On 02/04/2015 9:25 AM, Judith Vidal-Hall wrote:
> Thanks for raising the issue Gemma and as always big Phil some very
> good points raised. I'm keeping an eye on the new Institute for
> Personalized Medicine in Oxford. Cd be up to the same thing I fear.
> You get x but you lose a. 
>
> Meanwhile: can anyone tells why the UK media have taken zero interest
> in the Google case? I
>
> Sent from my iPhone
>
> On 2 Apr 2015, at 12:46, Phil Booth
> <medconfidential.coordinator at gmail.com
> <mailto:medconfidential.coordinator at gmail.com>> wrote:
>
>> Dear Gemma,
>>
>>  
>>
>> This is deeply concerning. I'm afraid I don't read Catalan/Spanish so
>> I have only been able to read the articles via Google Translate.
>>
>>  
>>
>> Please could you clarify a few things:
>>
>>  
>>
>> 1) If I understand correctly, the government's plan boils down to
>> identifiable patient data being passed to a commercial entity, as yet
>> undetermined, where it will be pseudonymised in some way and then
>> sold on to third parties.
>>
>>  
>>
>> ·         Do patients have a right to opt out?
>>
>> ·         If so, how are they to be informed and how do they exercise it?
>>
>> ·         How will the company that will be receiving the
>> population's identifiable medical records be chosen? Who owns it,
>> etc. etc.? (I'm not clear on the difference between ICS, AQuAS, etc.
>> -- though that may not be relevant.)
>>
>> ·         Which third parties will be able to buy data? Who will
>> approve them, and how?
>>
>> ·         Will the (pseudonymised)data itself be passed to the third
>> parties or will they only have access to it, e.g. via a 'safe setting'?
>>
>> ·         What independent oversight mechanisms, audit and
>> transparency processes are in place?
>>
>>  
>>
>> 2) Is the proposal to sell data that has been pseudonymised merely by
>> means of hashing one (or more) identifiers, i.e. they are doing
>> nothing about quasi-identifiers, and are ignoring all the evidence on
>> re-identification of linked individual-level data?
>>
>>  
>>
>> medConfidential has found it helpful to frame secondary uses of
>> patient data in terms of "consensual, safe and transparent". From
>> what I've read so far, the Catalan government's plans meet none of
>> these criteria.
>>
>>  
>>
>> Please feel free to contact me direct or give me a call on +44 7974
>> 230 839, if it would be helpful to chat.
>>
>>  
>>
>> Kind regards,
>>
>>  
>>
>> Phil
>>
>>  
>>
>> *From:*pi-discussion-bounces at privacyinternational.org
>> <mailto:pi-discussion-bounces at privacyinternational.org>
>> [mailto:pi-discussion-bounces at privacyinternational.org] *On Behalf Of
>> *Gemma Galdon Clavell
>> *Sent:* 02 April 2015 11:16
>> *To:* Javier Ruiz
>> *Cc:* Discussion list on Data Anonymisation;
>> pi-discussion at privacyinternational.org
>> <mailto:pi-discussion at privacyinternational.org>;
>> <SURVEILLANCE at jiscmail.ac.uk <mailto:SURVEILLANCE at jiscmail.ac.uk>>;
>> mydata-open-data
>> *Subject:* Re: [globalpriv-discussion] Catalonia to sell "anonymised"
>> medical records
>>
>>  
>>
>> Dear all,
>>
>> As you can see below, the Catalan government has agree to sell
>> medical records. A PIA was conducted by the regional DPA and there
>> should be a CPO, but the initiative has been launched despite the
>> opposition from Parliament and info on the implementation of the PIA
>> recommendations is not available.
>>
>> I raised some of the issues in El País last year
>> http://ccaa.elpais.com/ccaa/2014/10/24/catalunya/1414172573_550596.html,
>> and this led the Parliament to position itself against the
>> initiative. But the government has decided to move ahead anyway.
>>
>>  
>>
>> Any 'noise' you can make about this issue will be greatly
>> appreciated. While I think that Big Data carries a lot of potential
>> in the field of heath, without robust pseudonimity (hashing is
>> clearly not enough), transparency and guarantees this is and
>> extremely irresponsible move.
>>
>> Kind regards,
>>
>>
>> *Gemma G. Clavell*, PhD
>>
>> Eticas Research & Consulting
>>
>> C/ Ferlandina 49 (08001 Barcelona) / Reloj 2 (28770 Madrid)
>>
>> +34 936 005 400 - www.eticasconsulting.com
>> <http://www.eticasconsulting.com> - @eticasconsult
>>
>>  
>>
>> On Thu, Apr 2, 2015 at 12:07 PM, Javier Ruiz
>> <javier at openrightsgroup.org <mailto:javier at openrightsgroup.org>> wrote:
>>
>> HI, sorry it is only in Spanish.
>>
>>  
>>
>> Catalonian authorities agree to sell medical records to researchers
>> despite a vote by the regional Parliament to stop the project. 
>>
>>  
>>
>> http://politica.elpais.com/politica/2015/04/01/actualidad/1427892067_062214.html
>>
>>  
>>
>> Catalonian data protection authorities and academics had raised
>> concerns about anonymisation in the context of big data.
>>
>>  
>>
>> http://ccaa.elpais.com/ccaa/2014/11/01/catalunya/1414870966_992102.html
>>
>>  
>>
>>  
>>
>>  
>>
>> _______________________________________________
>> pi-discussion mailing list
>> Info and options:
>> http://mailman.greennet.org.uk/mailman/listinfo/pi-discussion
>> To unsubscribe, email
>> pi-discussion-unsubscribe at privacyinternational.org
>> <mailto:pi-discussion-unsubscribe at privacyinternational.org>
>
>
> _______________________________________________
> pi-discussion mailing list
> Info and options: http://mailman.greennet.org.uk/mailman/listinfo/pi-discussion
> To unsubscribe, email pi-discussion-unsubscribe at privacyinternational.org

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.okfn.org/pipermail/mydata-open-data/attachments/20150402/b7ae51e5/attachment-0003.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.okfn.org/pipermail/mydata-open-data/attachments/20150402/b7ae51e5/attachment-0003.sig>