Geographic Data and Privacy

Transcription

1 Geographic Data and Privacy June 5, 2006 Stephen A. Matthews Associate Professor of Sociology & Anthropology, Geography and Demography Director of the Geographic Information Analysis Core Population Research Institute Stephen A. Matthews GISPopSci - Monday June Slide 01

2 Outline GIS and Privacy Geocoding Examples? Leave time for questions. Mark Monmonier Spying with Maps: Surveillance Technologies and the Future of Privacy. Chicago, IL: University of Chicago Press. Stephen A. Matthews GISPopSci - Monday June Slide 02

3 GIS, Privacy and Confidentiality Surprisingly little has been written about privacy and confidentiality issues in GIS texts; including some of the classic GIS texts. The literature tends to be grey More specifically what literature exists tends to be drawn from developed countries and thereby tends to focus on the technological possibilities of geocoding rather than on concerns over privacy. Stephen A. Matthews GISPopSci - Monday June Slide 03

4 GIS, Privacy and Confidentiality Moreover, the discussion of law and GIS tends to focus on litigation issues associated with bad GIS rather than a concern over violating someone s privacy with the release of identifying data. If there is a message among some of the legal material it may well be that new technologies make old laws obsolete. Stephen A. Matthews GISPopSci - Monday June Slide 04

5 GIS and the Erosion of Privacy Recent developments: 1. The increasing resolution of remote sensing systems 2. The processes through which existing geographic information can be acquired, processed, and crossreferenced with other on-line information sources to reveal individual-level characteristics. 3. Cell phones and location-based services Stephen A. Matthews GISPopSci - Monday June Slide 05

6 Marc Armstrong (2002) Geographic Information Technologies and their potentially Erosion Effects on Personal Privacy Locations of 30 randomly selected addresses in Iowa City, IA Stephen A. Matthews GISPopSci - Monday June Slide 06

7 Marc Armstrong (2002) Geographic Information Technologies and their potentially Erosion Effects on Personal Privacy Stephen A. Matthews GISPopSci - Monday June Slide 07

8 Marc Armstrong (2002) Geographic Information Technologies and their potentially Erosion Effects on Personal Privacy Locations of 30 randomly selected addresses in Iowa City, IA 19 = Exact inverse address matched (63%) 63% 6 = Within one address (20%) 83% 4 = On the correct street segment (14%) 97% This level of local accuracy means that there is significant risk that individual-level dot mapped information can be compromised to reveal addresses, and by implication, personal identities. (p. 23) Stephen A. Matthews GISPopSci - Monday June Slide 08

9 Marc Armstrong (2002) Geographic Information Technologies and their potentially Erosion Effects on Personal Privacy Individual-level data should not be address-matched and released into public view unless it has been masked, for example by randomly displacing each symbol. Additional research is needed to provide empirical bounds on expectations about address-match inversion success rates under different assumptions about source map scale, symbolization, residential structure, and masking strategy. Stephen A. Matthews GISPopSci - Monday June Slide 09

10 Laws Etc... Great national variations are evident in the types of laws (and their enforcement) in regard to the use of geospatial information. The status of legal protection for geospatial databases in particular differs in different countries and is constantly in a state of flux. The laws impinge on the collection, dissemination, description, condition of sale, protection and liability aspects of geospatial data. Stephen A. Matthews GISPopSci - Monday June Slide 10

11 Laws Etc... Rhind (1996) identified different types of laws that influence the "marketing of information." These are: public access laws (e.g., Freedom of Information Acts); human rights laws; fair-trading/anti-trust laws; copyright and intellectual property laws; data protection laws; public procurement laws; and, legal liability laws. For an extensive discussion see Onsrud (1995). Stephen A. Matthews GISPopSci - Monday June Slide 11

12 U.S. Federal Law Federal laws that mandate protections for the privacy of citizens are applicable to the use of geospatial data. OMB states that geographic and spatial data must not compromise the privacy and security of personal data about citizens. The Health Insurance Portability Accountability Act recently increased the restrictions for sharing and disseminating patients health information to protect their privacy. Stephen A. Matthews GISPopSci - Monday June Slide 12

13 U.S. Federal Law However, many government agencies are required by the Freedom of Information Act (1996) to make information, critical to the welfare of individuals and collected/recorded with taxpayers dollars, available to the public. Thus a tension exists between an individual s RIGHT TO PRIVACY and an individual s RIGHT TO KNOW. Stephen A. Matthews GISPopSci - Monday June Slide 13

14 Privacy and GIS Following Wright (1997) privacy concerns are raised by GIS technology not only because some applications involve data about individuals but also because it can create a powerful new identifier - location. The concern is that location can become a personal identifier because GIS technology enables the synthesis and analysis of information not possible with other information management systems. Stephen A. Matthews GISPopSci - Monday June Slide 14

15 Invasion of Privacy? On the one hand, geospatial information should not raise privacy concerns because it is "factual" information about the land and resources, and therefore, by definition is not about identifiable people. On the other hand, the strong data integration and analysis capabilities of GIS, combined with the fact that most geospatial data are inherently local in nature, means that the technology has the potential to be far more privacy invasive than many other forms of technology (Onsrud, Johnson & Lopez, 1994). Stephen A. Matthews GISPopSci - Monday June Slide 15

16 Privacy and Data Use A related concern is that the analytical abilities of GIS will create the opportunity for information to be collected for one purpose to be used for unauthorized purposes or for users to be faced with the temptation to use information regardless of whether it is absolutely necessary or relevant to the task at hand (Wright, 1997). Stephen A. Matthews GISPopSci - Monday June Slide 16

17 Lego It has been suggested that the perfect toy for a child is Lego. By combining the smallest blocks we can aggregate and build many different end products. If we start with bigger blocks or we use "specialized" blocks the range of end products is limited. Stephen A. Matthews GISPopSci - Monday June Slide 17

18 Lego Many researchers (geographers, urban planners, environmental scientists, etc...) - work with area data not individual - prefer access to data on small area units - are frustrated when they find that the data are available only for large administrative units with no opportunity for research at a finer spatial resolution. It is like being given only the largest Lego blocks. Stephen A. Matthews GISPopSci - Monday June Slide 18

19 Spatial Resolution is Critical Many health related data sets are fundamentally with individuals and few (if any) "routinely" release detailed geographic identifiers because of important privacy and confidentiality considerations. In such situations the researcher is faced with using health data that are aggregated to predefined geographical units. Stephen A. Matthews GISPopSci - Monday June Slide 19

20 Spatial Resolution and Substantive Questions Substantive issues concern the validity and usefulness of particular areal units for health planning and analysis. areal units are particularly sacred once they have been established, even though they later may become serious obstacles to the solutions of contemporary problems Abler, Adams, and Gould (1971) Stephen A. Matthews GISPopSci - Monday June Slide 20

21 What Resolution (Scale) is Appropriate? Administrative units often encompass diverse physical environments and heterogeneous populations, frequently differ in population distribution, size and areal extent. Many areal units are often not comparable to one another and they have little basis in population and environmental factors relevant to public health. Cromley and McLafferty (2002) Stephen A. Matthews GISPopSci - Monday June Slide 21

22 Geocoding Features of the Earth are by definition "positioned" and can "geocoded." Typically, we refer to features having direct or indirect positioning. Direct positioning is given by a set of coordinates based on a reference system. Indirect positioning is where location is defined by common usage of geographic description including narrative (e.g., 15 miles north of DC) or by reference to a zoning system (e.g., MD 20705) though some zonal systems are "fuzzy" (e.g., Appalachia) and zones can even sometimes geographical categories of place rather than actual geographies or places (e.g., urban/rural). Stephen A. Matthews GISPopSci - Monday June Slide 22

23 Past and Future Geocoding In the past much "positioning" of social, economic, demographic and health information has been indirect. Geocoding provides the opportunity to use direct positioning. Note: New technologies are changing the way in which geographic information is being captured, handled and used. Today maps (and geospatial data) are more and more accurate and more and more interconnected through the use of geocodes. Stephen A. Matthews GISPopSci - Monday June Slide 23

24 Geocoding and Value Added The most fundamental advantage of geocoding is the capacity to "add value" where typically the discussion focuses on the linkage of multiple data sets to expand the range of applications that may be envisaged. Note: There is increasing scientific interest in sustainable development, human health and wellbeing, poverty and inequality, global environmental change, and related issues of human-environment relations. Researchers in these fields need to compare data on social and environmental phenomena at the same spatial and temporal scale. Stephen A. Matthews GISPopSci - Monday June Slide 24

25 Geocoding and Value Added #2 Geocodes enable researchers to integrate data sets together and thereby extend the number of independent variables that can be used in models. For example: models that combine remote sensed environmental data with individual, household and/or community data have the potential to improve understanding of the determinants of various land-use changes. The integration of environmental, agricultural, climate and other data with DHS data brings together disparate data that would otherwise be isolated (unconnected). Stephen A. Matthews GISPopSci - Monday June Slide 25

26 Stephen A. Matthews GISPopSci - Monday June Slide 26

27 Source: UNEP GRID-Arendal Stephen A. Matthews GISPopSci - Monday June Slide 27

28 Source: UNEP GRID-Arendal Stephen A. Matthews GISPopSci - Monday June Slide 28

29 Geocoding and Neighborhood/Geographic Context Rindfuss and Stern (1998) suggest from the social science perspective, an important reason for using geocoded data is to gather information on the context that shapes social phenomena. The role of context has been central to the theories and empirical work of numerous social scientists, sociologists, economists, geographers, anthropologists, etc. Stephen A. Matthews GISPopSci - Monday June Slide 29

30 Confidentiality Confidentiality is almost invisible in the GIS literature, even the applied GIS literature (there are notable texts on the social aspects of GIS - see Pickles, 1995). The creator of information should be careful not to produce data sets that will be used "against" individuals or groups. In the case of GIS there is potential for abuse and for it to become a technology of surveillance and control. Stephen A. Matthews GISPopSci - Monday June Slide 30

31 Confidentiality Curry (1996, 1999) and Goss (1994) observe that with technological developments increasingly everything is open to view and that geocoding more and more information will lead to a world without privacy - or a radically different form of privacy. It is likely that the increasingly finer resolution and availability of geocoded data and their linking to survey data will fuel public concerns about invasion of privacy. We may unwittingly undercut the right to privacy. Stephen A. Matthews GISPopSci - Monday June Slide 31

32 As Researchers We Must act responsibly maintain individual respondent confidentiality by aggregating up to a level where individual identity cannot be revealed, dispel rumors that confidentiality is not being maintained or that data will be used inappropriately. Stephen A. Matthews GISPopSci - Monday June Slide 32

33 Handling Confidentiality Two methods by aggregation of individual responses to larger units of analysis. remove all identifiers of the respondent including geographic identifiers are removed from the dataset. The latter means that it would not be possible to link the data set in question to any other "geocoded" data sets. Stephen A. Matthews GISPopSci - Monday June Slide 33

34 Why is this my problem? 1. If you use individual or household level data that are geocoded, it IS your problem. Note: Geocoding can be at the household or cluster level (clusters are often the second stage of a random-sampling multistaged study design (villages, census enumeration areas). 2. If you match polygons (areas) with attributes, even aggregate data, it MAY be your problem. Based on D. Balk (2005) Confidentiality and Spatially-Explicit Data (GISPopSci Workshop, Penn State June 2, 2005) Stephen A. Matthews GISPopSci - Monday June Slide 34

35 Who s Burden 1. Research teams 2. Funding Agencies 3. Institutional Review Boards 4. The Data Archives There is a Collective burden Based on D. Balk (2005) Confidentiality and Spatially-Explicit Data (GISPopSci Workshop, Penn State June 2, 2005) Stephen A. Matthews GISPopSci - Monday June Slide 35

36 Example Public Dissemination of Data: Boston Renaissance Resource Kit. A survey of 1820 households in with decennial census for 351 towns. There are 400+ variables with customized cross-tabulations. User can download 30+ Access tables with data with ID (one for FIPS code) and shapefiles (with FIPS code). Based on D. Balk (2005) Confidentiality and Spatially-Explicit Data (GISPopSci Workshop, Penn State June 2, 2005) Stephen A. Matthews GISPopSci - Monday June Slide 36

37 Two Individuals (A) 1. A Vietnamese, foreign-born (refugee), female, aged 18-34, in Marlborough (town of 36,000+) with at least some college education residing in her own home. She is not a citizen, works for the government, and is married with two children. 2. A Hispanic woman, foreign-born female aged in Malden (56,000+) with less then high school education, in her own home. She is not a citizen, drives her own car to work, and is married with two children. Based on D. Balk (2005) Confidentiality and Spatially-Explicit Data (GISPopSci Workshop, Penn State June 2, 2005) Stephen A. Matthews GISPopSci - Monday June Slide 37

38 Two Individuals (B) Using Census data on Town name, percent women, race/ethnicity percent, percent foreign-born, percent owner occupied, percent high school graduates, and percent within certain age groups. There are only 4 persons matching the Vietnamese respondent in Marlborough (or a 22% chance of identification) There are 29 in Malden matching the Hispanic respondent (a 3.4% chance of identification) Based on D. Balk (2005) Confidentiality and Spatially-Explicit Data (GISPopSci Workshop, Penn State June 2, 2005) Stephen A. Matthews GISPopSci - Monday June Slide 38

39 Two Individuals (B) There is much more information that could be used and matched from the survey and the Census. 22.0% chance of identification 3.4% chance of identification These chances don t seem high but as Balk suggested if a doctor gave these odds for a significant illness, one would be very concerned. Based on D. Balk (2005) Confidentiality and Spatially-Explicit Data (GISPopSci Workshop, Penn State June 2, 2005) Stephen A. Matthews GISPopSci - Monday June Slide 39

40 Solutions? We need to review old (and new) statistical techniques for protecting confidential data. Tabular data = masking, synthetic data, dropping small number of cases Spatial data = adding spatial noise, spatial aggregation Stephen A. Matthews GISPopSci - Monday June Slide 40

41 Solutions? Others suggest Data usage centers or facilities (enclave virtual enclaves centers for integrated analyis) - data are ready to use - computationally secure environment - analysis that does not compromise confidentiality may leave facility - individuals take oaths to protect confidential data Severely limit data access. Stephen A. Matthews GISPopSci - Monday June Slide 41

42 Census geographies and context? Internet and Telephone Lookup Stephen A. Matthews GISPopSci - Monday June Slide 42

43 Stephen A. Matthews GISPopSci - Monday June Slide 43

44 Stephen A. Matthews GISPopSci - Monday June Slide 44

45 Stephen A. Matthews GISPopSci - Monday June Slide 45

46 Stephen A. Matthews GISPopSci - Monday June Slide 46

47 Stephen A. Matthews GISPopSci - Monday June Slide 47

48 Stephen A. Matthews GISPopSci - Monday June Slide 48

49 Stephen A. Matthews GISPopSci - Monday June Slide 49

50 Stephen A. Matthews GISPopSci - Monday June Slide 50

51 Stephen A. Matthews GISPopSci - Monday June Slide 51

52 1% Public Use Microdata Area (PUMA) % Public Use Microdata Area (PUMA) Stephen A. Matthews GISPopSci - Monday June Slide 52

53 Stephen A. Matthews GISPopSci - Monday June Slide 53

54 Stephen A. Matthews GISPopSci - Monday June Slide 54

55 Stephen A. Matthews GISPopSci - Monday June Slide 55

56 Stephen A. Matthews GISPopSci - Monday June Slide 56

57 Stephen A. Matthews GISPopSci - Monday June Slide 57

58 Stephen A. Matthews GISPopSci - Monday June Slide 58

59 What is in a Zip Code? Potential Rating Index by Zip Markets PRIZM NE segmentation Stephen A. Matthews GISPopSci - Monday June Slide 59

60 Stephen A. Matthews GISPopSci - Monday June Slide 60

61 Stephen A. Matthews GISPopSci - Monday June Slide 61

62 Stephen A. Matthews GISPopSci - Monday June Slide 62

63 Stephen A. Matthews GISPopSci - Monday June Slide 63