22

I often work on mapping sensitive patient level data. Whilst I feel I have a good grasp of many of the governance issues around this (ie when to use binning and k-anonymity techniques) but I'd like to improve my knowledge on this.

Here is a good example of why this is of importance: Spatial confidentiality and GIS: re-engineering mortality locations from published maps about Hurricane Katrina

Does anyone have any good rules of thumb they employ when mapping sensitive data?

Are there any good resources out there which cover different methods of protecting confidentiality or provide guidance on the matter?

Chris W
  • 15,720
  • 2
  • 29
  • 47
Tumbledown
  • 1,683
  • 3
  • 20
  • 30
  • 2
    +1 (Incidentally, one data-anonymizing method suggested in a previous thread appears at http://gis.stackexchange.com/questions/31236/how-can-i-generate-irregular-grid-containing-minimum-n-points/31879#31879.) Could you clarify what you mean by "rules of thumb"? Do you seek technical solutions to hiding data details or are you looking for guidance concerning when, and by how much, data should be protected? – whuber Dec 24 '13 at 15:02
  • 1
    Primarily technical solutions, although guidance on the level of protection would also be useful. I see these as going hand-in-hand. For instance, very sensitive data consisting of many small numbers should be displayed using technique X or technique Y if demographic info is included. I was considering using hex-binning for a task but then suddenly though that I had no idea of the population in each hexagon. What if I displayed a value of 20 and then found that there were only 20 residents within that hexagon? I've also recently heard about the Modifiable Aerial Unit Problem relating to this. – Tumbledown Jan 13 '14 at 12:02
  • I've voted to close this as too broad because it is seeking both a list of "rules of thumb" and a list of resources. – PolyGeo Jan 28 '17 at 02:34

4 Answers4

8

This discussion is sorely needed in the GIS profession, and I put a lot of blame on higher education for neglecting this topic.

That said, here is some interesting, if not outdated, literature on the topic. The only real consensus between these resources is that there is no consensus in the GIS profession regarding personal privacy, but it should be a major concern.

Ethics of GIS | Jeremy Crampton

Protecting Personal Privacy in Using Geographic Information Systems | Harlan J. Onsrud, Jeff P. Johnson and Xavier Lopez | LINK UPDATED 1/11/17

Privacy and Confidentiality in Health GIS | LINK UPDATED 1/11/17

Sean Adkins
  • 502
  • 4
  • 10
  • 1
    Voted this up as really underscores the difficulty inherent (still) in this area. Pickles really (and on purpose) opened such a massive can of worms with his observations that its nigh on impossible to address every possible act of non-disclosure. There is always the thorny problem of contextual knowledge influencing a claim of disclosure as well - applied knowledge from outside of the original resource that can be used to identify an individual. Hashing data or spatially offsetting points can never negate such potential problems. So your pretty much left with your own ethical stance! – Andrew Tice Jan 28 '15 at 03:49
  • Standard anonymity procedures tend to make assumptions about normally distributed populations, when most spatial analysis tends to be far from normally distributed. Raster creation goes a little way to blurring the perceived accuracy of outputs so could be considered for general presentation. The original question mentioned the MAUP, and certainly using some form of SCAM at different spatial levels could assist, although it could be worthwhile in the end dusting off something like Openshaw's GAM? – Andrew Tice Jan 28 '15 at 03:57
  • Thanks for your input Andrew! I agree that blurring accuracy, weather through binning or rasterizing data, is a reasonable way to maintaining accuracy while preserving privacy. – Sean Adkins Jan 29 '15 at 15:03
  • ....I certainly like to weather my binnings on a regular basis! – Andrew Tice Jan 30 '15 at 05:13
  • 1
    @AndrewTice Can I ask what SCAM is? My de-acronymising abilities have abandoned me today! – Tumbledown Jan 30 '15 at 15:53
  • 1
    @Tumbledown - Sorry! It stands for Small Cell Adjustment Method. If you Google that in full you'll find literature from the ONS in the UK. Its one of the tried and tested methods for small level Census reporting, so it's applied for areal unit counts. Its a bit brute force, but since the ONS has used it widely there is a bit of justification for applying the method. – Andrew Tice Jan 31 '15 at 06:56
  • Just to note that unfortunately two of these links are now dead. I've been unable to find other sources for the linked documents. – Tumbledown Jan 10 '17 at 16:48
  • 1
    Yikes! Always a bummer when referencing older material. I will try to find working links and edit my post appropriately. Thanks! – Sean Adkins Jan 11 '17 at 18:12
4

These are the rules given by Eurostat when it asks to report locations of holdings. Locations are reported with rounded coordinates and in certain cases by applying an additional semi-random offset. I don't know if they give a good rule of thumb but at least these rules are used by a well-known European authority.

Concerning the location of the holding two principles are applied: (i) precise coordinates are not required; and (ii) a location with just one holding will be recoded.

(i) precise coordinates are not required: the longitude and latitude coordinates will not be required in terms of seconds or decimal fractions of minutes. It will be necessary to provide the location only to the nearest 5 minutes, which represent a land area of approximately 3,000-7,000 ha, depending on the location in Europe.

ii) a location with just one holding will be recoded: It is possible that in areas with very large holdings, the location specified to the nearest 5 minutes longitude and latitude may contain only one holding which would therefore be directly identifiable. To ensure that direct identification cannot take place, the locality with only one holding should be allocated to the nearest neighbouring point (chosen at random) with at least one another holding. If any of the 8 neighbouring locations do not have at least one holding, the neighbouring locations have to be extended until others are located with at least one other holding. However, whenever it is possible the agricultural holding should be allocated to the NUTS 3 region where it is situated.

user30184
  • 65,331
  • 4
  • 65
  • 118
3

This is very interesting field.

My first suggestion are these articles:http://dk-giscience.zgis.net/index.php/37-website/255-kounadi-ourania from researcher who has PHD disertation on that topic.

And this about masking sensitive geographic data: http://www.cartographicperspectives.org/index.php/journal/article/view/cp49-leitner-curtis

Also about health data: http://www.ij-healthgeographics.com/content/8/1/46

geof
  • 115
  • 4
1

I thought I'd put this useful site as an additional link: UK Anonymisation Network

It's not GIS specific and is aimed at the UK but gives some useful information and resources around mitigating the risk of disclosure.

They also run a series of free anonymisation workshops and clinics

Tumbledown
  • 1,683
  • 3
  • 20
  • 30
  • Another useful link, a decision making framework from UKAN: http://ukanon.net/ukan-resources/ukan-decision-making-framework/ – Tumbledown Jul 19 '16 at 13:54