Data Transparency Summer 2021 Multi-day Event

Thank you to our DT Summer Event 2021 sponsors...

A big thank you to all of our sponsors of the DT Summer Meeting 2021. This virtual event allowed us to screen our sponsors’ promotional videos in between presentation intervals, which was well received by our attendees.

A big thank you to our presenters across all three days, at the end of each day the audience has the opportunity to submit questions to the presenters, please see some of the questions and answers received. 

Could you please provide examples around the concept of “all the means reasonably likely to be used”? What should we consider or not consider when, for example, sharing data with researchers under a portal or when data is put in the public domain (e.g. Pol70 or PRCI)?

The risks of re-identification will be higher in the public domain compared to release in a secure portal. The level of de-identification would need to be stronger if released to the public, for example further aggregation and using techniques like differential privacy. For open data release, the reasonably likely test would need to consider more types of motivated intruder who may wish to re-identify and also what data may be available in the public domain, e.g. social media.

You mentioned “synthetic data” in your slides. Are there specific use cases where you believe synthetic data should be preferred?

Use cases could include health or financial data and also AI/ML projects needing access to training data – any use cases where sensitive data is processed such that synthetic data is necessary. The choice of technique is also an important consideration.

Once the data is de-identified, how should one demonstrate the data utility while it is posted publicly?

The data utility needs to be sufficient for the purposes of the processing but should be respectful to the principle of data minimisation. How utility is demonstrated will depend on the de-identification technique used. For example, differential privacy and the amount of noise added can be measured accurately.

From your experience, how much does the UK interpretation and methodology align with the GDPR?

I think they are aligned. We take a risk-based approach to anonymisation. Recital 26 of the GDPR also follows this approach by considering some of the objective factors that should be considered when assessing the risk of re-identification.