The Costs of Anonymization: Case Study Using Clinical Data.

Area of Science:

• Medical Informatics
• Data Science
• Health Data Privacy

Background:

• Clinical data sharing accelerates research but faces privacy barriers.
• Anonymization algorithms mitigate reidentification risk but can alter statistical properties.
• The privacy-utility trade-off in anonymization requires real-world evidence, which is scarce.

Purpose of the Study:

• To evaluate the privacy-utility trade-off of anonymized data in a real-world clinical setting.
• To comprehensively assess differently anonymized datasets from the German Chronic Kidney Disease (GCKD) study.

Main Methods:

• Utilized the GCKD dataset (5217 records, 70 variables).
• Applied a 2-step procedure to identify reidentification risks and set risk thresholds (0.02-1).
• Transformed data using generalization and suppression, varying anonymization via generic and use case-specific configurations; assessed utility using general (granularity, entropy) and specific (reproducibility) metrics.

Main Results:

• Reproducibility (95% CI overlap >90%) exceeded general utility metrics (granularity 68.2-87.6%, entropy 25.5-46.2%).
• Minimal non-overlapping 95% CIs (6/all analyses) were observed; most estimates showed >50% overlap.
• Use case-specific anonymization yielded higher reproducibility than generic methods at equivalent privacy levels.

Conclusions:

• Anonymization faces challenges in supporting multiple, potentially competing data uses.
• Use case-specific anonymization can enhance data utility while maintaining privacy.
• Consider the costs and privacy levels when evaluating anonymized data for various applications.