Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

Suppose I have a bunch of addresses of individuals participating in a certain study (most likely - health related, where privacy and ethical considerations are always important issues).

Nowadays, providers like Google or Yahoo offer decent results in terms of positional accuracy.

The North American Association of Central Cancer Registries (NAACCR) lists such options in their 'Geocoding Best Practices: Review of Eight Commonly Used Geocoding Systems' and 'A Geocoding Best Practices Guide' guides.

Cinnamon and Schuurman (2010) for example used BatchGeocode service as a part of their tool to investigate injuries in low resource setting.

Would you consider geocoding such addresses using online services, like Google Maps or OpenStreetMap a breach of privacy?

PS1 possibly related question.

PS2 recent article in Epidemiology (one of the leading, peer-review journals in the field) published short communication detailing instructions on how to geocode using Google Maps & Places APIs. Interestingly, not a word about security/privacy was mentioned...

share|improve this question
    
Community wiki scope question? –  artwork21 Jun 7 '11 at 16:49

10 Answers 10

up vote 10 down vote accepted

There is definitely a privacy implication here - particularly if you are working with small batches of data. Anyone who is attempting to mine the data stream will be able to make assumptions that all requests in the same batch have something in common - even if the medical condition or personal information is not disclosed over the wire.

A better technique is to batch up lots of unrelated data / patients for bulk geocoding.

For example - combine your data needing geocoding with other researchers - the more unrelated issues the better. Randomize the order of the requests. And once per day batch process through this queue, all at once.

Now it becomes vastly harder to mine the data, even if an attacker is able to overhear the geocoding requests.

share|improve this answer
    
Interesting! Any tool/platform that might facilitate this process? –  Nicolas Raoul May 15 at 3:09

Geocoding locally with encrypted files on a secure server would definitely be the gold standard for privacy. Using Tor would be the next best thing, if geocoding using a remote API is needed.

Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents ... the sites you visit from learning your physical location.

Along with injection of random addresses (as others here recommend) and using ssl (https) to encrypt communications to their endpoints (make sure you're also doing this), I can't think of a more secure way to geocode remotely than via the Tor Project. Whatever geocoding service you're using won't ever be able to identify where the requests ultimately came from, and with https no one else will, either. Note: don't use a geocoding service that requires an api key for this, or you'll no longer be anonymous. (Google doesn't require an api key anymore).

More details about using Tor are in my answer to a related question here.

share|improve this answer
    
Thanks, I haven't thought about Tor, but it seems like a good idea. –  radek Jun 7 '11 at 10:55
    
Even if using Tor, the geocoding server still receives your information, which is a fundamental breach of privacy. You can't trust the geocoding server. –  Nicolas Raoul May 15 at 3:12

This is an excellent question that I have been asked a number of times lately since I work for an address verification company called SmartyStreets.

First off, a postal address represents a single locatable point on the map. An address by itself is inherently benign because it doesn't have any additional information. Drawing a point on a map doesn't do anything. It is only when you begin to assign CONTEXT to that point (address) that it starts to mean something.

With that in mind, a postal address can represent a person, an organization, a building, a car, whatever. Once you start gathering multiple postal addresses you increase the context that can be derived from that grouping. Similarities can be determined to see what the addresses have in common. Still, just a grouping of addresses in a like area doesn't denote much context. I can look at a google map and see all the houses in a certain area. That's not a breach of privacy unless I have unauthorized access to privileged information.

Other points of context must be combined in order to actually give away any kind of private data. For example, a group of postal addresses that are submitted to an online service for address verification and/or geocoding doesn't give away information unless you know who submitted the list for processing. Once the list owner is known certain inferences can be made about the intended use of the list. Knowing this additional context, such as list owner and intended use, would certainly qualify as privileged information and can be a source of privacy breach.

Bringing the processing "in-house" so no external data service is involved is an option. It certainly excludes any type of unauthorized access to privileged information. Address verification and geocoding are not tasks for the uninitiated and certainly require advanced skills (meaning experience gained over time) in order to process very large lists without consuming inordinate amounts of time and resources. So bringing it in house is certainly an option, but does every company that has sensitive address information have the resources to do their own "secure" address processing (including geocoding) in house? No. (Although it would certainly mean job security for the readers of this website.)

There are ways to maintain the requisite privacy and still use online services. One method would be to create an account, get everything tested and figured out and then, using a temporary email address, set up a new account with an unrelated billing address associated with a credit card that can't be traced back to you. Processing the addresses on this account would theoretically not give away any valuable context and thus would maintain the privacy of the individuals on the list. (This is starting to sound like the movie Enemy Of The State.

If that sounds complex and unnecessary, I agree. A simpler method would be to take advantage of an API that uses HTTPS and POST and that doesn't store or log any of the data that you process. The use of HTTPS means that the only record would be a timestamp and the IP address that you call from. The underlying URL would not be known. Of course the account that you use would lead back to you BUT, that's not a problem because using a POST request allows you to attach a payload (in this case a batch of addresses) and the contents of the payload are not logged. Thus, the addresses that you submit are not on any server log. And the fact that they memory is wiped between each process means that those addresses aren't ever stored or logged and their transmission back to you is done over a secure connection. The end result is a log like this:

13Mar2012 06:31(-6) IP:12.134.223.12 UserID: 875564 -- POST QTY:3439942 -- [Processed]

Anyone that looks at the logs would see only that you processed some addresses and they would have no idea what addresses were processed. This satisfies even the strictest privacy policy requirements. It wouldn't make sense for me to point out that this type of service is available (and super fast) without mentioning where to find it. It's already built into the LiveAddress API service from SmartyStreets. Other services such as Cdyne, QAS, and ServiceObjects may also offer similar services but I haven't heard of any yet.

share|improve this answer
    
Thanks for detailed information. HTTPS definitely sounds like a reasonable idea. I presume SmartyStreets is limited to USA? –  radek Mar 23 '12 at 21:37
    
Yes, SmartyStreets address verification and geocoding is limited to US Postal Service addresses. –  Jeffrey Mar 30 '12 at 15:02

Possibly you could create an ID, split your table. Removing personally identifiable information. then rejoin the table after geocoding.

In the vein of (federated PCness) I suppose that you could prove that once you run the data on a server somewhere, then you did not maintain chain of custody.

I did find quite a bit of writing on the subject if you would like to follow...

Cloud possession and control

Electronic age possession and control

Google book

Legal implication of Cloud computing

If the enforcement is carried out to the letter-of-the-law, cloud computing could be completely shut out of government services.

share|improve this answer
    
thanks a lot for links; good background info. –  radek Dec 17 '10 at 20:10

No, you can geocode offline. If you are using online batch geocoders, how does converting addresses into geographic coordinates become a privacy issue? It would be more of an issue if everyone's name was included and publicized. As Brad mentions separate address with an ID and rematch it when addresses have been geocoded. Standard practice.

share|improve this answer
5  
I agree that you can geocode offline and not have to disclose any personal information. But I don't agree with, your suggestion that only considers the name and ID to be information that should be kept private. If you disclose the home address of a person, even without their name, you have essentially identified them. Think about putting publishing a map with points on the houses of people with Highly Embarassing Communicable Disease. –  DavidF Dec 16 '10 at 22:10
2  
As Mapperz said, as long as the information you are sending out is limited to the address, there should not be a problem. Don't include "HECD", or any other sensitive information, in the information you are sending out. –  jvangeld Dec 17 '10 at 1:19
1  
@DavidF every address has geographic coordinates - geocoding is 99.9% automated [computation] no privacy is lost. If you don't like it online don't put it there, use an offline version. –  Mapperz Dec 17 '10 at 4:14
2  
@jvangeld I still think that privacy could be breached in the online situation when a third party can combine the identity of the organization submitting the geocode request and the addresses. If the People's Front for the Treatment of Vampirism submits a batch geocode with 100 addresses in it, don't you think that a third party could reasonably assume that the 100 houses had people who were attempting to be cured of their 'alternative lifestyle'? Obviously, this is a pretty academic argument, but if you truly want to protect privacy and anonymity, I think that this is relevant. –  DavidF Dec 17 '10 at 15:08
1  
@DavidF opinion is very much to the point here: home address is regarded as very sensitive and could potentially lead to disclosure of study participants. If there are 1000 requests from an IP address of an institution studying vampirism, one could simply assume that they have addresses of potential 1000 vampires. My issue here is, can online geocoding service be regarded as 'safe party' in such conditions? Can you be accussed of sharing your data with unauthorized party that is not part of study? Party that through the geocoding process potentialy got access to data? –  radek Dec 17 '10 at 20:27

Geocoding is low risk Earlier this year we worked with some hospitals and this question came up. The geocoding service itself wasn't a big concern because we stripped all but ID and address from the data,used secure transfer (https) and the TOS our in-house geocoder specified privacy protections that were enough to meet their criteria.

Displaying Locations Annonymously is harder The trickier bit was displaying maps of sparse data while maintaining annonymonity. The first option the client asked for was to add a random "fudge" into each point so that that actual house location was obscured. The problem with this approach is that the size of the fudge required is quite large (1/2 mile or more) (what if someone lives on a farm) and the tendency of map users to take the point locations as accurate. We settled on aggregating the points displaying enough to be anonymous while still having a useful map. A norm from other industries we have worked in seems to be that the aggregation unit must have at least 7 to 10 records.

share|improve this answer

I presume you are geocoding it, and not making the results public? If so, then how would the cloud be aware of what that data represents?

Presumably you can also obfuscate any data that you geocode with random data hiding any inherent pattern that may exist.

share|improve this answer
    
correct, the point is to obtain set of geographic coordinates for a given dataset. all the rest of analysis will be offline and anything published further will never utilize individual level information. i like the idea of obfuscating dataset! –  radek Dec 17 '10 at 20:09

I don't know if this is new since the question was asked, but if anyone was wondering in the google maps api v3 you can use SSL (https). Also the privacy section of the NAACCR Best Practices Guide it does discuss these issues.

share|improve this answer

In Austria this would definitely be a privacy issue.

First of all: Health data is classified as sensitive and there is no doubt that it is not allowed to overhand it to any third parties without explicit agreement of the person which is related to that dataset.

Even if it is anonymized: It is possible to geocode this health data, but it is also possible to geocode publicy available Name-to-Adress Registers (Phonebook) and to connect health data to persons living there, so adresses are also classified as personal data.

This leads to the result, that you'd not be allowed to geocode this dataset by sending it to a third party without explicitely asking your participants.

share|improve this answer

Do you need an exact geocode or general area? You might be able to use just the postal code or partial postal code f

share|improve this answer
    
@user1466: exact geocode would be definitely a preference here. –  radek Dec 17 '10 at 20:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.