Empowering open data sharing for social good: a privacy-aware approach
The free use, reuse and redistribution of open data makes it invaluable in driving progress, fostering innovation and helping to solve humanitarian and societal challenges, as demonstrated in the context of Covid-19 . Open data sharing enables broader participation in research studies and faster conclusions, as it is accessible to everyone. In addition, government legislation requiring transparency has led to an expansion of publicly available data resources. Several open government data initiatives have emerged in diverse countries, particularly for data related to the public sector. In particular, the European Union ( https://digital-strategy.ec.europa.eu/en/policies/legislation-open-data ), and the U.S. Chief of Information Officer’s Council ( https://www.cio.gov/handbook/it-laws/ogda/ ), among others, encourage governments to provide access to public sector information, promoting its reuse and accelerating innovation. The vast advantages of open access to data have led to transformative shifts. However, with this came the emergence of privacy threats, prompting legislators to develop regulatory measures to ensure the responsible and ethical use of data. As a result, regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), have emerged to balance the facilitation of open data with the protection of individual privacy rights, ultimately contributing to innovation and progress while safeguarding against potential risks. In response to these developments, many organisations, institutions and governments have endorsed the FAIR (Findable, Accessible, Interoperable and Reusable) guiding principles . FAIR describes considerations for exploration, sharing and reuse in data publishing environments. Besides privacy concerns, multiple challenges have been identified, such as benefits and costs, legislative issues, data formats and infrastructure limitations, among others . Furthermore, a large amount of collected data is often unused as it is redundant or obsolete. The gathering of data should follow the principles of data protection by design and by default approach. Article 25 of the GDPR requires data controllers to implement appropriate technical and organisational measures to ensure that data protection principles are integrated into processing activities from the outset (data protection by design) and that, by default, only the necessary personal data for each specific purpose is processed (data protection by default). This approach enables organisations to optimise data storage efficiency, improving sustainability and bolstering their environmental footprint. In light of the numerous benefits and associated privacy risks of public dissemination of data, it is imperative to protect the privacy of individuals while maximising the data utility for diverse applications. Achieving an optimal trade-off between these conflicting goals is a challenge, amplified by the scarcity of professionals with the required expertise in both fields. Therefore, to achieve optimal outcomes, it is essential to assemble a multidisciplinary team dedicated to balancing privacy preservation and utility maximisation. During the pandemic, the second-largest hospital in Portugal received a large number of data access requests for clinical research purposes. Given the high interest in accessing Covid-19 data, the hospital created a team of experts with a heterogeneous set of skills to assess the possibility of providing a de-identified data set of high quality and maintaining its utility for the majority of the requests. This work was therefore carried out in collaboration with the hospital. We provided recommendations for transforming the Covid-19 patient data set in accordance with data protection principles and standards. While related work focuses on transforming data following de-identification algorithms , such as k -anonymity , our approach involves safeguarding the data set through a customised transformation guided by the input of the experts. The main purpose of this paper is to demonstrate the importance of healthcare practitioners’ insights in enhancing domain understanding, thereby enabling the application of appropriate privacy-preserving techniques (PPTs), and at the same time the importance of raising healthcare professionals’ awareness of privacy-enhancing technologies. We comprehensively detail the steps of the de-identification process, aiming to achieve an optimal balance between mitigating privacy risks and preserving data utility. Most importantly, we provide a high-quality and statistically useful data set that is privacy-compliant for sharing for social good. We are committed to fostering understanding, innovation and the development of tools that are critical to addressing the challenges posed by the pandemic. 

In the context of privacy-aware, appropriate governance mechanisms should be established to comply with privacy and cybersecurity laws. Under Article 35 of the GDPR, a Data Protection Impact Assessment (DPIA) is mandatory when a new processing activity is likely to result in a high risk to the rights and freedoms of natural persons. A DPIA is a procedure that should be employed as an early cautioning framework, as it identifies potential privacy risks. Several problems can be detected during the design of the project, such as the inappropriate legal grounds for processing and the exercise of data subjects’ rights. When there is a need to design an (pseudo)anonymisation protocol, a suitable framework is the Five Safes , . Such a framework aims to define (pseudo)anonymisation protocols and how rigorous the protocol should be. The Five Safes framework is usually used as a privacy risk assessment and support to the decision-making. Decision trees are also used to evaluate data sharing practices to help researchers in the process. The urgency of data sharing has become even more crucial, particularly in light of the evolving Covid-19 pandemic, where timely access to multiple data sources was paramount due to the rapid dynamics of the pandemic and the fact that many case reports were rapidly becoming outdated. Such resources, coupled with data-driven methodologies, facilitate enhancements in the response to control the spread of the virus. For instance, it was demonstrated that the shortage of face masks can be effectively managed through open government data in conjunction with online services . Several initiatives have been created to provide up-to-date Covid-19 information, such as Google Health Covid-19 Open Data Repository ( https://health.google.com/covid-19/open-data/ ), Facebook Data For Good Covid-19 ( https://dataforgood.facebook.com/dfg/tools/covid-19-forecasts ) and Data Science for Social Good Portugal ( https://github.com/dssg-pt/covid19pt-data ). However, some limitations and difficulties were found in most of the available Covid-19 data . These challenges include inconsistencies in data formats, outdated reports, difficulties in estimating mortality, and lack of information at the individual record level. Within the scope of Covid-19, public health authorities and employers are allowed by national law to process personal data under the conditions set by the EDPB (European Data Protection Board). Since the beginning of the pandemic, several research groups in Portugal have expressed a strong desire to contribute to the production of useful evidence for decision-making. To support these efforts, they requested access to healthcare data related to Covid-19. In response, the DGS (Portuguese Directorate-General of Health) released to the public a document describing the data set to be provided and a form to be filled in by researchers interested in requesting this data set. Researchers obtained the data set by submitting a study protocol approved by an ethics committee. However, the data set proved to be of limited value due to poor data quality and raised concerns about patient re-identification with minimal effort . Risk-benefit evaluation Identifiability plays a key role in privacy laws and regulations. Basic frameworks provide an understanding of how an IT system processes personal data, which helps such systems comply with the Privacy by Design definition. For many organisations, de-identification starts from the stored identified data. However, sharing data within the same organisation but across different departments or with external entities poses multiple challenges. In this section, we introduce Five Safes framework that helps to evaluate the risks and benefits of releasing or sharing a data set. Risk evaluation Five Safes framework has been used by organisations for more than a decade as it ensures that data utility is proportional to data privacy. As this framework is a privacy risk assessment and an auxiliary to the decision-making, it is recommended for researchers whether in the healthcare field, economics or commerce. The release could be directly made to researchers under certain circumstances and criteria or publicly available for any subject as open data. Figure summarises each step of the Five Safes framework. At each stage of the framework, there is a set of data transformations and technical and administrative controls that help to mitigate the risks. We briefly review the goals that we should address in each stage. Safe Projects : Understand the data flow to identify the legal and ethical limits of sharing personal information. Considerations include the origin of the data, recipient access requirements, and methods for identifying and protecting personal data. Safe People : Besides the primary recipient, others may access the data, raising concerns about unintentional or intentional re-identification. To prevent a re-identification, we must assume that potential attackers have access to data and some background knowledge. Safe Settings : The data environment must be secure to prevent skilled attackers from re-identifying individuals. Standard controls include access restrictions, collaboration agreements, retention policies, and personal data handling should be accountable and transparent. Safe Data : After considering the people and environment in which the data is managed, the probability of attack and re-identification in the event of a successful attack must be assessed. The evaluation of the context and the data allows the identification of the threads to be managed. Safe Outputs : Although the original purpose of de-identified data has been established, recipients may draw new conclusions. Careful consideration is needed to avoid misusing such insights. Defining a privacy threshold based on context and data evaluation is essential. Benefit evaluation In addition to assessing the privacy risks of a data-driven project, it is fundamental to understand whether the data to be shared or released to the public will bring benefits to those who access it. In general, benefits are evaluated according to the usability/utility of specific or open data sets. The benefits of sharing data between organisations, or between departments within the same organisation, include reducing redundant effort, improving collaboration, and enabling effective use of resources. In the case of open data, the benefits can be social, environmental, health, political, economic and many others. These benefits can improve government transparency and public engagement, stimulate innovation, optimise government processes, and enable public/private data merging. When assessing the benefits, it is important to be aware of the privacy risks when collecting, processing and sharing data. Therefore, to incorporate the benefits into the risk-benefit assessment, the following considerations should be made : the attributes that can provide positive outcomes for an organisation, the forms in which the attributes will be beneficial, the possible recipients who will use the data, the likelihood of successful benefits in using the data, and the positive effects on people. Risk-benefit matrix It is essential to assess the risks and benefits of data sharing, as it may result in the release of useless data or it may result in the release of data posing some risks to the data subject. The legitimate benefits to individuals or society and the potential harms of inappropriate data processing must be weighed up beforehand. It is also essential to ensure the adequacy of the data subject’s consent to disclosure. Green et al . present an approach to privacy preservation that can be adopted by cities and other stakeholders releasing data to the public. The authors focus on four main recommendations: ( i ) risk-benefit analyses to further inform the development of open data projects, ( ii ) implementing appropriate safeguards in each stage of the data lifecycle, ( iii ) developing operational structures and processes that focus on privacy mitigation, and ( iv ) engaging the public as an essential aspect of data management. There are different matrices for representing risk-benefit levels, which help to understand at first-hand whether a data set could be publicly available. Figure shows an example with four levels, namely low (L), moderate (M), high (H) and very high (VH). The most common level of publication is moderate (represented by x ticks). If the benefit is very high, it should be considered whether the risks outweigh the release of the data being analysed. It should be noted that the benefit is calculated at the asset level, not at the data set level. 

Identifiability plays a key role in privacy laws and regulations. Basic frameworks provide an understanding of how an IT system processes personal data, which helps such systems comply with the Privacy by Design definition. For many organisations, de-identification starts from the stored identified data. However, sharing data within the same organisation but across different departments or with external entities poses multiple challenges. In this section, we introduce Five Safes framework that helps to evaluate the risks and benefits of releasing or sharing a data set. Risk evaluation Five Safes framework has been used by organisations for more than a decade as it ensures that data utility is proportional to data privacy. As this framework is a privacy risk assessment and an auxiliary to the decision-making, it is recommended for researchers whether in the healthcare field, economics or commerce. The release could be directly made to researchers under certain circumstances and criteria or publicly available for any subject as open data. Figure summarises each step of the Five Safes framework. At each stage of the framework, there is a set of data transformations and technical and administrative controls that help to mitigate the risks. We briefly review the goals that we should address in each stage. Safe Projects : Understand the data flow to identify the legal and ethical limits of sharing personal information. Considerations include the origin of the data, recipient access requirements, and methods for identifying and protecting personal data. Safe People : Besides the primary recipient, others may access the data, raising concerns about unintentional or intentional re-identification. To prevent a re-identification, we must assume that potential attackers have access to data and some background knowledge. Safe Settings : The data environment must be secure to prevent skilled attackers from re-identifying individuals. Standard controls include access restrictions, collaboration agreements, retention policies, and personal data handling should be accountable and transparent. Safe Data : After considering the people and environment in which the data is managed, the probability of attack and re-identification in the event of a successful attack must be assessed. The evaluation of the context and the data allows the identification of the threads to be managed. Safe Outputs : Although the original purpose of de-identified data has been established, recipients may draw new conclusions. Careful consideration is needed to avoid misusing such insights. Defining a privacy threshold based on context and data evaluation is essential. Benefit evaluation In addition to assessing the privacy risks of a data-driven project, it is fundamental to understand whether the data to be shared or released to the public will bring benefits to those who access it. In general, benefits are evaluated according to the usability/utility of specific or open data sets. The benefits of sharing data between organisations, or between departments within the same organisation, include reducing redundant effort, improving collaboration, and enabling effective use of resources. In the case of open data, the benefits can be social, environmental, health, political, economic and many others. These benefits can improve government transparency and public engagement, stimulate innovation, optimise government processes, and enable public/private data merging. When assessing the benefits, it is important to be aware of the privacy risks when collecting, processing and sharing data. Therefore, to incorporate the benefits into the risk-benefit assessment, the following considerations should be made : the attributes that can provide positive outcomes for an organisation, the forms in which the attributes will be beneficial, the possible recipients who will use the data, the likelihood of successful benefits in using the data, and the positive effects on people. Risk-benefit matrix It is essential to assess the risks and benefits of data sharing, as it may result in the release of useless data or it may result in the release of data posing some risks to the data subject. The legitimate benefits to individuals or society and the potential harms of inappropriate data processing must be weighed up beforehand. It is also essential to ensure the adequacy of the data subject’s consent to disclosure. Green et al . present an approach to privacy preservation that can be adopted by cities and other stakeholders releasing data to the public. The authors focus on four main recommendations: ( i ) risk-benefit analyses to further inform the development of open data projects, ( ii ) implementing appropriate safeguards in each stage of the data lifecycle, ( iii ) developing operational structures and processes that focus on privacy mitigation, and ( iv ) engaging the public as an essential aspect of data management. There are different matrices for representing risk-benefit levels, which help to understand at first-hand whether a data set could be publicly available. Figure shows an example with four levels, namely low (L), moderate (M), high (H) and very high (VH). The most common level of publication is moderate (represented by x ticks). If the benefit is very high, it should be considered whether the risks outweigh the release of the data being analysed. It should be noted that the benefit is calculated at the asset level, not at the data set level. 

Five Safes framework has been used by organisations for more than a decade as it ensures that data utility is proportional to data privacy. As this framework is a privacy risk assessment and an auxiliary to the decision-making, it is recommended for researchers whether in the healthcare field, economics or commerce. The release could be directly made to researchers under certain circumstances and criteria or publicly available for any subject as open data. Figure summarises each step of the Five Safes framework. At each stage of the framework, there is a set of data transformations and technical and administrative controls that help to mitigate the risks. We briefly review the goals that we should address in each stage. Safe Projects : Understand the data flow to identify the legal and ethical limits of sharing personal information. Considerations include the origin of the data, recipient access requirements, and methods for identifying and protecting personal data. Safe People : Besides the primary recipient, others may access the data, raising concerns about unintentional or intentional re-identification. To prevent a re-identification, we must assume that potential attackers have access to data and some background knowledge. Safe Settings : The data environment must be secure to prevent skilled attackers from re-identifying individuals. Standard controls include access restrictions, collaboration agreements, retention policies, and personal data handling should be accountable and transparent. Safe Data : After considering the people and environment in which the data is managed, the probability of attack and re-identification in the event of a successful attack must be assessed. The evaluation of the context and the data allows the identification of the threads to be managed. Safe Outputs : Although the original purpose of de-identified data has been established, recipients may draw new conclusions. Careful consideration is needed to avoid misusing such insights. Defining a privacy threshold based on context and data evaluation is essential. 

In addition to assessing the privacy risks of a data-driven project, it is fundamental to understand whether the data to be shared or released to the public will bring benefits to those who access it. In general, benefits are evaluated according to the usability/utility of specific or open data sets. The benefits of sharing data between organisations, or between departments within the same organisation, include reducing redundant effort, improving collaboration, and enabling effective use of resources. In the case of open data, the benefits can be social, environmental, health, political, economic and many others. These benefits can improve government transparency and public engagement, stimulate innovation, optimise government processes, and enable public/private data merging. When assessing the benefits, it is important to be aware of the privacy risks when collecting, processing and sharing data. Therefore, to incorporate the benefits into the risk-benefit assessment, the following considerations should be made : the attributes that can provide positive outcomes for an organisation, the forms in which the attributes will be beneficial, the possible recipients who will use the data, the likelihood of successful benefits in using the data, and the positive effects on people. 

It is essential to assess the risks and benefits of data sharing, as it may result in the release of useless data or it may result in the release of data posing some risks to the data subject. The legitimate benefits to individuals or society and the potential harms of inappropriate data processing must be weighed up beforehand. It is also essential to ensure the adequacy of the data subject’s consent to disclosure. Green et al . present an approach to privacy preservation that can be adopted by cities and other stakeholders releasing data to the public. The authors focus on four main recommendations: ( i ) risk-benefit analyses to further inform the development of open data projects, ( ii ) implementing appropriate safeguards in each stage of the data lifecycle, ( iii ) developing operational structures and processes that focus on privacy mitigation, and ( iv ) engaging the public as an essential aspect of data management. There are different matrices for representing risk-benefit levels, which help to understand at first-hand whether a data set could be publicly available. Figure shows an example with four levels, namely low (L), moderate (M), high (H) and very high (VH). The most common level of publication is moderate (represented by x ticks). If the benefit is very high, it should be considered whether the risks outweigh the release of the data being analysed. It should be noted that the benefit is calculated at the asset level, not at the data set level. 

To ensure safe data , we apply a privacy mechanism to protect individuals’ personal information and provide sufficient granularity for useful and meaningful further data analysis. One such mechanism is the de-identification process . Note that, the decision on the appropriate level of de-identification usually depends on the purpose of the data processing. The de-identification process consists of four main phases: ( i ) attributes classification, ( ii ) raw disclosure risk and data utility assessment, ( iii ) application of PPTs based on disclosure risk, data structure and attributes’ characteristics, and ( iv ) re-assessment of disclosure risk and data utility. If there is no balance between the two measures, the transformation techniques should be refined; otherwise, the de-identified data can be shared. Quantifying the risk of disclosure is challenging since disclosure of confidential information generally occurs when an attacker has external information that the data controller often cannot anticipate. Typically, an attacker is someone who has the skills, resources and motivation to re-identify data subjects or to derive new information about them from de-identified data. If an attacker has more background knowledge than assumed, the risk of disclosure may be underestimated. Therefore, the controller needs to make prudent assumptions about such knowledge to predict the risk of disclosure. Typically, the controller determines the privacy risk under different scenarios (threat models), e.g. different sets of attributes that attackers may know. Such attributes are classified as follows: direct identifiers which directly identify an individual, such as name and social security number attributes; quasi-identifiers (QI) which may lead to identification when combined, such as date of birth, gender and profession; and sensitive attributes which correspond to highly critical attributes usually protected by law and regulation such as religion, health information and ethnic group. Once the attributes classification has been established, the risk of disclosure, often referred to as the risk of re-identification, is assessed. We use the two most popular measures, k -anonymity and record linkage, to assess singling out and linkability respectively. K -anonymity , indicates how many k occurrences appear in the data set w.r.t a set of QI values. If k = 1, an attacker can single out the corresponding individual as the record is unique in the data set. For better protection, k must be greater than 1. Record linkage , measures the re-identification ability by linking two records. Given two data sets, A (original) with a elements and B (de-identified) with b elements, the resulting comparison space is the product of all possible pairs of records ( A × B = {( a , b ): a ∈ A , b ∈ B }). For each pair, a similarity function is used that produces values between 0 and 1, where 1 represents maximum similarity and means that two data points are identical. Thus, for each de-identified record b ∈ B , the distance-based record linkage finds an original record a ∈ A that minimises the distance to b , given the similarity function. To limit the risk of disclosure, appropriate PPTs are applied. There are two main categories of PPTs: non-perturbative and perturbative. We use the best-known examples of non-perturbative techniques: global re-coding (or generalisation) and suppression, which aim to reduce the amount of information in the original data. Global re-coding groups values into broader categories, while suppression replaces values with a missing value (NA) or a special character (*, ?). For the perturbative category, we use noise, which, unlike non-perturbative techniques, distorts the original data by adding or subtracting random values from the original value. To proceed with the de-identification process, it is essential to acknowledge that the team representing the data controller (healthcare professionals) is responsible for addressing the Five Safes framework and conducting a comprehensive risk-benefit assessment. This preliminary analysis is important to assess the relevance of the study and the associated risks from data collection to publication, before starting any data transformation procedures. In summary, the benefits of data sharing for this particular study include: simplification of the process of data availability, allowing rapid and secure access by healthcare researchers, and liberate the information systems teams and the Data Protection Officer from recurrent requests for access to the same data set. On the other hand, given the sensitive nature of patient data, it is imperative to mitigate data protection risks while ensuring the fundamental right to privacy of patients. Therefore, the establishment of a pseudonymisation methodology within data structures intended for research purposes becomes indispensable, allowing the risk of re-identification of patients to be objectively quantified. Accordingly, the decision to release the data to the general public or to specific recipients is of great importance. Data The provided data concerns Covid-19 cases in Portugal, namely, hospitalised cases from March 2020 to January 2021. Our study was approved by the Ethics Review Board at the Faculty of Medicine, University of Porto. Regarding consent, we refer to the waiver granted by the Portuguese Data Protection Authority following its analysis of the Data Protection Impact Assessment ( https://www.cnpd.pt/umbraco/surface/cnpdDecision/download/122003 ). The data set comprises 1,716 individuals and 38 attributes. Such attributes include, for instance, the individuals’ age (with an average of 67 years), the date of the first positive Covid-19 test, the date of hospitalisation and discharge, the outcome of the case (indicating recovery or death), and several indicators of other pathologies. The definition of the attributes of this data set was based on the same attributes of the data set mentioned above, which was made available to researchers by the DGS in 2020 and proved to be not only not of limited quality , but also with the possibility of patient re-identification without much effort . To better understand the data, we present a selection of attribute values and their description in Table . We add value to the data set by analysing the distribution of values and performing feature engineering. Crucially, the validation of these new attributes is undertaken in collaboration with epidemiologists and bio-statisticians to ensure their clinical relevance. We create the attribute HospitalisationDays , which indicates the number of days that an individual was hospitalised by subtracting DateOfHospitalisation from DateOfDischarge . Then, these two attributes are deleted. Additionally, some attributes are excluded from the data set. Although the Hospitalisation attribute is very relevant in the context of the pandemic, this attribute takes the same value, since this data set is only about the hospitalised patients. As such, this attribute is of no statistical interest. Others, such as CloseContactRecordId , DateOfOnset and PlaceOfInfection have no statistical interest as there were many cases with missing information. 

The provided data concerns Covid-19 cases in Portugal, namely, hospitalised cases from March 2020 to January 2021. Our study was approved by the Ethics Review Board at the Faculty of Medicine, University of Porto. Regarding consent, we refer to the waiver granted by the Portuguese Data Protection Authority following its analysis of the Data Protection Impact Assessment ( https://www.cnpd.pt/umbraco/surface/cnpdDecision/download/122003 ). The data set comprises 1,716 individuals and 38 attributes. Such attributes include, for instance, the individuals’ age (with an average of 67 years), the date of the first positive Covid-19 test, the date of hospitalisation and discharge, the outcome of the case (indicating recovery or death), and several indicators of other pathologies. The definition of the attributes of this data set was based on the same attributes of the data set mentioned above, which was made available to researchers by the DGS in 2020 and proved to be not only not of limited quality , but also with the possibility of patient re-identification without much effort . To better understand the data, we present a selection of attribute values and their description in Table . We add value to the data set by analysing the distribution of values and performing feature engineering. Crucially, the validation of these new attributes is undertaken in collaboration with epidemiologists and bio-statisticians to ensure their clinical relevance. We create the attribute HospitalisationDays , which indicates the number of days that an individual was hospitalised by subtracting DateOfHospitalisation from DateOfDischarge . Then, these two attributes are deleted. Additionally, some attributes are excluded from the data set. Although the Hospitalisation attribute is very relevant in the context of the pandemic, this attribute takes the same value, since this data set is only about the hospitalised patients. As such, this attribute is of no statistical interest. Others, such as CloseContactRecordId , DateOfOnset and PlaceOfInfection have no statistical interest as there were many cases with missing information. 

Initial disclosure risk In this study, we perform several assumptions regarding QIs. We consider as QIs the attributes that have a high potential to increase the re-identification risk when combined with other attributes, for instance, Age , DateOfFirstPositiveLabResult , HospitalisationDays , Gender and Outcome . Table shows the percentage of re-identification risk for several scenarios, i.e. combinations of QIs, determined by the percentage of the number of equivalence classes of size 1 ( k = 1) in the data set. An apparent result is the increased risk when we increase the set of selected QIs. We also observe that the date attribute has a strong influence on the risk. This is due to the granularity of the data, i.e. dates in the format “YYYY/MM/DD HH:MM:SS” are too aggressive for privacy, as they provide too much detail, which increases the number of unique cases. An important preliminary analysis in the evaluation of privacy risks is the selection of certain subsets where an attacker is assumed to have a high degree of certainty about specific background knowledge. In such a case, we assume that an attacker knows, for example, that a person has died, has been in a nursing home, has been in intensive care, or whether the case is related to newborns. Table shows the risk analysis for such subsets. We observe an increase in the risk when the subsets have a smaller number of observations. This is a normal result as the small subsets have a lower number of individuals sharing the same information and therefore a high number of unique cases. Note that we use age in months instead of years for the newborn subset. To prevent re-identification in this subset, we should remove the attributes AgeDay and AgeMonth . As the risk is also very critical for the nursing home subset, further protection should be applied. As this data set provides information on several pathologies, special attention should be paid to these subsets, as certain pathologies are only common to a small number of people, e.g. people with HIV, pregnant women or even obese young men. An attacker can easily re-identify these cases by accessing social networks where people share pictures. Henceforth, a strong recommendation for similar cases is to group such attributes into one that we can call, “Other pathologies” for example. In the de-identification process, the utility is usually measured using the raw data. However, this applies when the release’s purpose is, for example, modelling tasks. In our case, the utility was measured at each iteration of the PPTs by assessing the impact of the transformations on the data set. Effectiveness of privacy-preserving techniques During data analysis, we noticed some re-incidents, which refer to people who have been hospitalised more than once. However, such cases represent a very small proportion of the data and may be potentially relevant to an attacker. Therefore, we apply suppression at the row level by retaining only the first date of hospitalisation for re-incidents due to early discharge. This transformation reduces the number of observations to 1,685 individuals, resulting in a slight increase in the risk of re-identification. Table provides the reassessment of the disclosure risk. All scenarios have increased the disclosure risk compared to Table . Henceforth, we compare the re-identification risk of the posterior data transformations with these results. To reduce the re-identification risk, we focus on attributes with dates and hours as these have a large impact on the re-identification risk. We start by removing the hours to reduce the level of detail. In each iteration, it is important to re-assess the risk of re-identification to verify the impact of the transformation on the privacy risk. As a result, the risk of re-identification drops to 89.02% when we consider age, date of test result and gender. However, there is still a high percentage of singling out cases that should be addressed. As we have previously observed in the subsets analysis, there are a few individuals who have gone to a nursing home, and as such a case corresponds to old people, it requires special attention. Furthermore, we highlight the importance of minimal information sharing for privacy protection, which can be solved by aggregating nursing home to home cases. We call such an aggregation “Recovered”. Figure shows the distribution of individuals concerning outcome cases for the original data and after this transformation. The risk remains the same for the QIs combination that includes HospitalisationDays or DateOfFirstPositiveLabResult , as this transformation has no effect when combined with such attributes. On the other hand, considering Age , Gender and the updated Outcome , the risk drops from 8% to 6.5%. From Table , we can verify that the re-identification risk increases substantially with the addition of the attribute HospitalisationDays . At this point, it was really interesting to see that the epidemiologist and bio-statistician, once they understood the PPT considered earlier, actively contributed by suggesting that this attribute be presented in quartiles, as the level of statistical utility remains appropriate to the goal. This approach drastically reduced the risk of re-identification from 65.28% to 8.7%. This was an important takeout of this process: it is of utmost importance to raise the PPTs awareness of the end user, as once they understand it they take the lead and propose new methods that do not compromise the utility of the data. Such a transformation is illustrated in Fig. , where we show how many days certain individuals were hospitalised. For this purpose, we present the distribution of the original data and the frequency of the observations after applying the quartiles. We can observe that this generalisation allows us to maintain the distribution close to the original, and therefore preserve the utility. To further reduce the risk of re-identification, we can also generalise the age. An approach that preserves more utility is to generalise across different intervals. In general, fewer intervals are applied at the top of the curve (more individuals in the same age range) and fewer intervals at the tails of the curve. Figure shows an example applied with different ranges (left). To make the newborns indistinguishable from other individuals, we have aggregated them to the following ages. The figure on the right shows the effect of the transformation using the dynamic ranges. In addition to maintaining a high utility, we obtain a re-identification risk of 0% for the combination of Age and Gender . Similarly, adding the recoded result reduces the risk from 6.5% to 1.8%. However, this approach has not been further developed, because to add more knowledge to the data set, it is essential to combine it with other data sets. The bio-statistician argued that in general, open data platforms for open science in Portugal present the age in intervals of 5 years. For this reason, in Fig. we provide the respective frequency of ages considering such an interval. Although the level of risk is maintained, the granularity of the data is reduced. At this point, only further processing of the date type attribute remains to achieve a reasonable level of re-identification risk. To this end, we start the experiments by applying generalisation over periods of days in the date of the first positive case. Table shows three examples of such periods for the DateOfFirstPositiveLabResult attribute regarding the QIs. It should be noted that the results are sequential, i.e. we present the results with the previous transformations. Thus, these results refer to the generalisation of the date of the first positive case, the re-coded outcome, the days of hospitalisation in quartiles and the generalisation of age in intervals of 5 years. As mentioned above, by removing the hour from this attribute we obtained an 89.02% risk of re-identification for Age , DateOfFirstPositiveLabResult and Gender . Although the use of a 2-day interval results in a considerable reduction, 42.6% is still a cause for concern. Even considering a 7-day interval is not a satisfactory result. Thus, we need intervals longer than 7 days, which may undermine the utility. Given that this study is over a short period, and the dates of the test results are important for further understanding of the Covid-19 cases, we need to preserve as much information as possible. A plausible solution that is best suited for this purpose is the addition of noise. Such an approach will distort the dates, making them untruthful, but this ensures that there is no loss of granularity, as several records have the date very close to the original. We therefore apply noise between the interval [-3, 3], which means that for each date a random value is added from this range. Once the noise is introduced, k anonymity is inappropriate as this transformation does not involve changing the granularity of the data. In this case, the equivalence classes including the DateOfFirstPositiveLabResult attribute will be equivalent with or without noise. Therefore, we use record linkage to address such a shortcoming, which allows us to determine how many records in the transformed data set are identical to the original. This comparison is made using only QIs to limit the comparison space. Table shows the results after introducing noise in the values of the date attribute. Contrary to the results with k -anonymity, the more added noise, the lower the risk of re-identification, as an attacker is less likely to have the exact information of all QIs. However, record linkage does not evaluate whether a matched pair is a true match or not. A false match is also critical from a privacy perspective, as misleading information about an individual may be released. We noticed that 17% are false positives, which means that despite a match rate of about 30%, the margin of error is over 50%. Regarding the utility with the noise addition, Fig. shows the distribution before and after the transformation on DateOfFirstPositiveLabResult attribute, and it is visible that the two distributions remain very similar. The final results are presented in Table with the corresponding PPTs and their parameterisation. We present the results with the two metrics, record linkage when QIs contain attributes with noise, and k -anonymity otherwise. With the iterations between the privacy and the health experts, it was possible to reduce the re-identification risk to 0% for some scenarios with a high utility, and therefore no further transformations will be performed on the data. Nevertheless, as initially mentioned, it is important to analyse subsets, as an attacker’s knowledge may be underestimated. Therefore, Table shows the impact of the final transformations on the re-identification risk when the attacker knows in advance the age, gender and pathology associated with a specific individual. Of the previous QIs attributes, we only consider Age and Gender for this analysis, as these attributes are generally the easiest for an attacker to obtain. We observe that all subsets maintain the re-identification risk close to 0%. 

In this study, we perform several assumptions regarding QIs. We consider as QIs the attributes that have a high potential to increase the re-identification risk when combined with other attributes, for instance, Age , DateOfFirstPositiveLabResult , HospitalisationDays , Gender and Outcome . Table shows the percentage of re-identification risk for several scenarios, i.e. combinations of QIs, determined by the percentage of the number of equivalence classes of size 1 ( k = 1) in the data set. An apparent result is the increased risk when we increase the set of selected QIs. We also observe that the date attribute has a strong influence on the risk. This is due to the granularity of the data, i.e. dates in the format “YYYY/MM/DD HH:MM:SS” are too aggressive for privacy, as they provide too much detail, which increases the number of unique cases. An important preliminary analysis in the evaluation of privacy risks is the selection of certain subsets where an attacker is assumed to have a high degree of certainty about specific background knowledge. In such a case, we assume that an attacker knows, for example, that a person has died, has been in a nursing home, has been in intensive care, or whether the case is related to newborns. Table shows the risk analysis for such subsets. We observe an increase in the risk when the subsets have a smaller number of observations. This is a normal result as the small subsets have a lower number of individuals sharing the same information and therefore a high number of unique cases. Note that we use age in months instead of years for the newborn subset. To prevent re-identification in this subset, we should remove the attributes AgeDay and AgeMonth . As the risk is also very critical for the nursing home subset, further protection should be applied. As this data set provides information on several pathologies, special attention should be paid to these subsets, as certain pathologies are only common to a small number of people, e.g. people with HIV, pregnant women or even obese young men. An attacker can easily re-identify these cases by accessing social networks where people share pictures. Henceforth, a strong recommendation for similar cases is to group such attributes into one that we can call, “Other pathologies” for example. In the de-identification process, the utility is usually measured using the raw data. However, this applies when the release’s purpose is, for example, modelling tasks. In our case, the utility was measured at each iteration of the PPTs by assessing the impact of the transformations on the data set. 

During data analysis, we noticed some re-incidents, which refer to people who have been hospitalised more than once. However, such cases represent a very small proportion of the data and may be potentially relevant to an attacker. Therefore, we apply suppression at the row level by retaining only the first date of hospitalisation for re-incidents due to early discharge. This transformation reduces the number of observations to 1,685 individuals, resulting in a slight increase in the risk of re-identification. Table provides the reassessment of the disclosure risk. All scenarios have increased the disclosure risk compared to Table . Henceforth, we compare the re-identification risk of the posterior data transformations with these results. To reduce the re-identification risk, we focus on attributes with dates and hours as these have a large impact on the re-identification risk. We start by removing the hours to reduce the level of detail. In each iteration, it is important to re-assess the risk of re-identification to verify the impact of the transformation on the privacy risk. As a result, the risk of re-identification drops to 89.02% when we consider age, date of test result and gender. However, there is still a high percentage of singling out cases that should be addressed. As we have previously observed in the subsets analysis, there are a few individuals who have gone to a nursing home, and as such a case corresponds to old people, it requires special attention. Furthermore, we highlight the importance of minimal information sharing for privacy protection, which can be solved by aggregating nursing home to home cases. We call such an aggregation “Recovered”. Figure shows the distribution of individuals concerning outcome cases for the original data and after this transformation. The risk remains the same for the QIs combination that includes HospitalisationDays or DateOfFirstPositiveLabResult , as this transformation has no effect when combined with such attributes. On the other hand, considering Age , Gender and the updated Outcome , the risk drops from 8% to 6.5%. From Table , we can verify that the re-identification risk increases substantially with the addition of the attribute HospitalisationDays . At this point, it was really interesting to see that the epidemiologist and bio-statistician, once they understood the PPT considered earlier, actively contributed by suggesting that this attribute be presented in quartiles, as the level of statistical utility remains appropriate to the goal. This approach drastically reduced the risk of re-identification from 65.28% to 8.7%. This was an important takeout of this process: it is of utmost importance to raise the PPTs awareness of the end user, as once they understand it they take the lead and propose new methods that do not compromise the utility of the data. Such a transformation is illustrated in Fig. , where we show how many days certain individuals were hospitalised. For this purpose, we present the distribution of the original data and the frequency of the observations after applying the quartiles. We can observe that this generalisation allows us to maintain the distribution close to the original, and therefore preserve the utility. To further reduce the risk of re-identification, we can also generalise the age. An approach that preserves more utility is to generalise across different intervals. In general, fewer intervals are applied at the top of the curve (more individuals in the same age range) and fewer intervals at the tails of the curve. Figure shows an example applied with different ranges (left). To make the newborns indistinguishable from other individuals, we have aggregated them to the following ages. The figure on the right shows the effect of the transformation using the dynamic ranges. In addition to maintaining a high utility, we obtain a re-identification risk of 0% for the combination of Age and Gender . Similarly, adding the recoded result reduces the risk from 6.5% to 1.8%. However, this approach has not been further developed, because to add more knowledge to the data set, it is essential to combine it with other data sets. The bio-statistician argued that in general, open data platforms for open science in Portugal present the age in intervals of 5 years. For this reason, in Fig. we provide the respective frequency of ages considering such an interval. Although the level of risk is maintained, the granularity of the data is reduced. At this point, only further processing of the date type attribute remains to achieve a reasonable level of re-identification risk. To this end, we start the experiments by applying generalisation over periods of days in the date of the first positive case. Table shows three examples of such periods for the DateOfFirstPositiveLabResult attribute regarding the QIs. It should be noted that the results are sequential, i.e. we present the results with the previous transformations. Thus, these results refer to the generalisation of the date of the first positive case, the re-coded outcome, the days of hospitalisation in quartiles and the generalisation of age in intervals of 5 years. As mentioned above, by removing the hour from this attribute we obtained an 89.02% risk of re-identification for Age , DateOfFirstPositiveLabResult and Gender . Although the use of a 2-day interval results in a considerable reduction, 42.6% is still a cause for concern. Even considering a 7-day interval is not a satisfactory result. Thus, we need intervals longer than 7 days, which may undermine the utility. Given that this study is over a short period, and the dates of the test results are important for further understanding of the Covid-19 cases, we need to preserve as much information as possible. A plausible solution that is best suited for this purpose is the addition of noise. Such an approach will distort the dates, making them untruthful, but this ensures that there is no loss of granularity, as several records have the date very close to the original. We therefore apply noise between the interval [-3, 3], which means that for each date a random value is added from this range. Once the noise is introduced, k anonymity is inappropriate as this transformation does not involve changing the granularity of the data. In this case, the equivalence classes including the DateOfFirstPositiveLabResult attribute will be equivalent with or without noise. Therefore, we use record linkage to address such a shortcoming, which allows us to determine how many records in the transformed data set are identical to the original. This comparison is made using only QIs to limit the comparison space. Table shows the results after introducing noise in the values of the date attribute. Contrary to the results with k -anonymity, the more added noise, the lower the risk of re-identification, as an attacker is less likely to have the exact information of all QIs. However, record linkage does not evaluate whether a matched pair is a true match or not. A false match is also critical from a privacy perspective, as misleading information about an individual may be released. We noticed that 17% are false positives, which means that despite a match rate of about 30%, the margin of error is over 50%. Regarding the utility with the noise addition, Fig. shows the distribution before and after the transformation on DateOfFirstPositiveLabResult attribute, and it is visible that the two distributions remain very similar. The final results are presented in Table with the corresponding PPTs and their parameterisation. We present the results with the two metrics, record linkage when QIs contain attributes with noise, and k -anonymity otherwise. With the iterations between the privacy and the health experts, it was possible to reduce the re-identification risk to 0% for some scenarios with a high utility, and therefore no further transformations will be performed on the data. Nevertheless, as initially mentioned, it is important to analyse subsets, as an attacker’s knowledge may be underestimated. Therefore, Table shows the impact of the final transformations on the re-identification risk when the attacker knows in advance the age, gender and pathology associated with a specific individual. Of the previous QIs attributes, we only consider Age and Gender for this analysis, as these attributes are generally the easiest for an attacker to obtain. We observe that all subsets maintain the re-identification risk close to 0%. 

Nowadays, privacy faces three main challenges: unawareness of the importance of protecting private information, lack of knowledge about privacy preservation methods, and the idea that preserving privacy destroys utility, which has long been nurtured but needs to be deconstructed. It is crucial to convey that although the process of de-identification requires extra effort, it is possible to preserve privacy without compromising utility too much. In this regard, one of the most important tasks for a successful de-identification is the cleaning of the data set that needs to be protected. Some criticisms about the quality of the data provided for open data on Covid-19 cases in Portugal have already been pointed out . If we use a data set of very poor quality, privacy transformations will also produce data of equal or worse quality. It is very important to perform a pre-analysis, remove statistically insignificant attributes and aggregate cases to minimise information. Once the healthcare professionals understood the purpose of the de-identification, they participated in all steps, including providing several suggestions to improve privacy while maintaining utility. This iteration between the privacy and healthcare teams resulted in a faster and more efficient process. From the de-identification process, we can obtain different levels of de-identification, in which the anonymised data ensures maximum confidentiality. Achieving “true” anonymity requires irreversible anonymisation where individuals cannot be re-identified, and therefore anonymous data is no longer considered personal data under the GDPR. In contrast, personal data that has been de-identified (low risk) or pseudonymised, yet could still be used to re-identify an individual, is considered personal data and remains within the scope of the GDPR. Hence, de-identified data are not anonymous . In our study, we ensure a 0% re-identification risk in both the worst-case scenario (where all QIs are known) and the basic scenario (knowledge limited to Age and Gender ); one should note that certain combinations of QIs may still pose a small, non-zero re-identification risk. Additionally, even after transforming the QIs, there remains an inherent disclosure risk due to the potential privacy loss in specific attribute values. Consequently, the transformed data remains subject to privacy laws and regulations. Given that maintaining the utility of the data is equally essential and that data custodians accept these inherent risks, we therefore focus on obtaining de-identified data rather than anonymous data. Although this study is tailored to a specific use case, our approach uses widely recognised data transformation techniques, applicable to several applications. We include generalisation and suppression (non-perturbative techniques) and noise addition (a perturbative technique), which have been widely used in the relevant literature – . Generalisation, which involves broadening categories for numerical or categorical attributes, is generally straightforward as it involves recoding. However, suppression and noise addition should be avoided to preserve the utility of the data. Suppression is recommended for redundant or non-essential information, in line with the GDPR’s principle of minimisation, which aims to limit the unnecessary release of data. In cases where data granularity is essential, generalisation is not feasible; thus, adding noise is an alternative option that aims to protect privacy by introducing uncertainty and maintaining data granularity. A key step in this process is the identification of QIs, as some attributes inherently carry higher re-identification risks, especially when combined. Assessing which attributes may be easily accessible to intruders is critical to effective privacy risk analysis. Domain knowledge and an understanding of the intended use of the data are essential for optimal identification of such critical attributes, choice of PPTs and their respective parameterisation. The final task after de-identification is to submit a report demonstrating the benefits of data release, including all de-identification steps and corresponding risk levels, to the supervisory authority, which will assess whether the risk is acceptable to proceed to open data release or data sharing (GDPR, Article 51). Nevertheless, all elements of the processing of personal data should be publicly described in a comprehensive overview. Further concerns Despite the successful outcome, additional concerns need to be addressed. We focus on single out cases as they pose the greatest risk. However, one person sharing information with another means that each has a 50% chance of being re-identified. In our study, the PPTs applied ensured that no individual was singled out or shared information with another. Nevertheless, 3 individuals share the same information, posing a re-identification risk of 33%. Since we guarantee a minimum of equivalence classes of size 3, we consider such an outcome reasonable for our particular case. To achieve higher equivalence classes, the PPT parameters must be readjusted or other techniques must be used in combination. Furthermore, we focus only on identity disclosure. However, it should be considered whether there are cases of possible attribute disclosure. For instance, we found that several women of similar age have cerebrovascular problems. Although it is not possible to directly identify each of these women, we can conclude that they all suffer from the same pathology. This means that there is a loss of privacy, namely the disclosure of attributes. Typically, the main concern of the regulator is to ensure that there is no entity disclosure. However, this concern should not be ignored. Other metrics should be used to evaluate attribute disclosure, such as l -diversity and t -closeness . We also stress that the record linkage metric is useful for both re-identification and attribute disclosure . Although the two risk metrics used are applied for different purposes, namely k -anonymity on truthful and record linkage untruthful transformations, both metrics should be used simultaneously, since the former gives us the proportion of single outs, whereas the latter provides the proportion of information that is unprotected. Concluding remarks Open data has long been used to benefit society in a variety of domains. The pandemic has highlighted the urgency of making data available to the public. However, several key concerns must be carefully addressed throughout the entire process, from data acquisition to open data release. These concerns typically include: ( i ) transparency and consent about the data use, ( ii ) data minimisation by sharing only what is essential for public benefit, ( iii ) privacy prioritisation through de-identification techniques, ( iv ) ensure that the data remains accurate and unbiased after transformations to prevent misleading insights, and ( v ) accountability by documenting the applied methods to align with public trust and data protection laws. While prioritising individual privacy is essential, achieving it is a complex and challenging task. Data are often minimised and generalised to the point of being statistically useless. This is a consequence of misuse of optimal PPTs or high PPT parameters, use of misleading case studies, disregard of the purpose of releasing the data, and many other causes. To conclude, we emphasise that de-identification experts should educate and promote awareness on how to protect private information. Collaboration with data custodians - individuals well-versed in the data domain - is essential. During this process, the experts should demonstrate the different stages of the de-identification process, as this is the first step in raising awareness of the workflow involved. The synergy between the data protection team, the data release team and the end users is crucial for producing a statistically significant data set with a high level of privacy protection. Nevertheless, the process of collaborating across different groups may present two main challenges. On the one hand, data custodians may focus on the usability of the data, while the data protection team may prioritise strict privacy measures. On the other hand, demonstrating and validating each step of the de-identification process can be resource-intensive, especially when coordinating multiple groups. Aligning the conflicting priorities and balancing resources and time are critical to successful de-identification. Finally, we stress the importance of incorporating periodic privacy impact assessments into data handling practices to identify potential risks and ensure ongoing compliance with ethical standards. This could involve updating data practices as new threats or technologies emerge. 

Despite the successful outcome, additional concerns need to be addressed. We focus on single out cases as they pose the greatest risk. However, one person sharing information with another means that each has a 50% chance of being re-identified. In our study, the PPTs applied ensured that no individual was singled out or shared information with another. Nevertheless, 3 individuals share the same information, posing a re-identification risk of 33%. Since we guarantee a minimum of equivalence classes of size 3, we consider such an outcome reasonable for our particular case. To achieve higher equivalence classes, the PPT parameters must be readjusted or other techniques must be used in combination. Furthermore, we focus only on identity disclosure. However, it should be considered whether there are cases of possible attribute disclosure. For instance, we found that several women of similar age have cerebrovascular problems. Although it is not possible to directly identify each of these women, we can conclude that they all suffer from the same pathology. This means that there is a loss of privacy, namely the disclosure of attributes. Typically, the main concern of the regulator is to ensure that there is no entity disclosure. However, this concern should not be ignored. Other metrics should be used to evaluate attribute disclosure, such as l -diversity and t -closeness . We also stress that the record linkage metric is useful for both re-identification and attribute disclosure . Although the two risk metrics used are applied for different purposes, namely k -anonymity on truthful and record linkage untruthful transformations, both metrics should be used simultaneously, since the former gives us the proportion of single outs, whereas the latter provides the proportion of information that is unprotected. 

Open data has long been used to benefit society in a variety of domains. The pandemic has highlighted the urgency of making data available to the public. However, several key concerns must be carefully addressed throughout the entire process, from data acquisition to open data release. These concerns typically include: ( i ) transparency and consent about the data use, ( ii ) data minimisation by sharing only what is essential for public benefit, ( iii ) privacy prioritisation through de-identification techniques, ( iv ) ensure that the data remains accurate and unbiased after transformations to prevent misleading insights, and ( v ) accountability by documenting the applied methods to align with public trust and data protection laws. While prioritising individual privacy is essential, achieving it is a complex and challenging task. Data are often minimised and generalised to the point of being statistically useless. This is a consequence of misuse of optimal PPTs or high PPT parameters, use of misleading case studies, disregard of the purpose of releasing the data, and many other causes. To conclude, we emphasise that de-identification experts should educate and promote awareness on how to protect private information. Collaboration with data custodians - individuals well-versed in the data domain - is essential. During this process, the experts should demonstrate the different stages of the de-identification process, as this is the first step in raising awareness of the workflow involved. The synergy between the data protection team, the data release team and the end users is crucial for producing a statistically significant data set with a high level of privacy protection. Nevertheless, the process of collaborating across different groups may present two main challenges. On the one hand, data custodians may focus on the usability of the data, while the data protection team may prioritise strict privacy measures. On the other hand, demonstrating and validating each step of the de-identification process can be resource-intensive, especially when coordinating multiple groups. Aligning the conflicting priorities and balancing resources and time are critical to successful de-identification. Finally, we stress the importance of incorporating periodic privacy impact assessments into data handling practices to identify potential risks and ensure ongoing compliance with ethical standards. This could involve updating data practices as new threats or technologies emerge. 

