Would you consider online geocoding a breach of privacy?

Question

Suppose I have a bunch of addresses of individuals participating in a certain study (most likely - health related, where privacy and ethical considerations are always important issues).

Nowadays, providers like Google or Yahoo offer decent results in terms of positional accuracy.

The North American Association of Central Cancer Registries (NAACCR) lists such options in their 'Geocoding Best Practices: Review of Eight Commonly Used Geocoding Systems' and 'A Geocoding Best Practices Guide' guides.

Cinnamon and Schuurman (2010) for example used BatchGeocode service as a part of their tool to investigate injuries in low resource setting.

Would you consider geocoding such addresses using online services, like Google Maps or OpenStreetMap a breach of privacy?

A possibly related question is Geocoding USA addresses that cannot be sent over internet?

An article in Epidemiology (one of the leading, peer-review journals in the field) published short communication detailing instructions on how to geocode using Google Maps & Places APIs. Interestingly, not a word about security/privacy was mentioned.

Answer 1

There is definitely a privacy implication here - particularly if you are working with small batches of data. Anyone who is attempting to mine the data stream will be able to make assumptions that all requests in the same batch have something in common - even if the medical condition or personal information is not disclosed over the wire.

A better technique is to batch up lots of unrelated data / patients for bulk geocoding.

For example - combine your data needing geocoding with other researchers - the more unrelated issues the better. Randomize the order of the requests. And once per day batch process through this queue, all at once.

Now it becomes vastly harder to mine the data, even if an attacker is able to overhear the geocoding requests.

Answer 2

Geocoding locally with encrypted files on a secure server would definitely be the gold standard for privacy. Using Tor would be the next best thing, if geocoding using a remote API is needed.

Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents ... the sites you visit from learning your physical location.

Along with injection of random addresses (as others here recommend) and using ssl (https) to encrypt communications to their endpoints (make sure you're also doing this), I can't think of a more secure way to geocode remotely than via the Tor Project. Whatever geocoding service you're using won't ever be able to identify where the requests ultimately came from, and with https no one else will, either. Note: don't use a geocoding service that requires an api key for this, or you'll no longer be anonymous. (Google doesn't require an api key anymore).

More details about using Tor are in my answer to a related question here.

Answer 3

This is an excellent question that I have been asked a number of times lately since I work for an address verification company called SmartyStreets.

First off, a postal address represents a single locatable point on the map. An address by itself is inherently benign because it doesn't have any additional information. Drawing a point on a map doesn't do anything. It is only when you begin to assign CONTEXT to that point (address) that it starts to mean something.

With that in mind, a postal address can represent a person, an organization, a building, a car, whatever. Once you start gathering multiple postal addresses you increase the context that can be derived from that grouping. Similarities can be determined to see what the addresses have in common. Still, just a grouping of addresses in a like area doesn't denote much context. I can look at a google map and see all the houses in a certain area. That's not a breach of privacy unless I have unauthorized access to privileged information.

Other points of context must be combined in order to actually give away any kind of private data. For example, a group of postal addresses that are submitted to an online service for address verification and/or geocoding doesn't give away information unless you know who submitted the list for processing. Once the list owner is known certain inferences can be made about the intended use of the list. Knowing this additional context, such as list owner and intended use, would certainly qualify as privileged information and can be a source of privacy breach.

Bringing the processing "in-house" so no external data service is involved is an option. It certainly excludes any type of unauthorized access to privileged information. Address verification and geocoding are not tasks for the uninitiated and certainly require advanced skills (meaning experience gained over time) in order to process very large lists without consuming inordinate amounts of time and resources. So bringing it in house is certainly an option, but does every company that has sensitive address information have the resources to do their own "secure" address processing (including geocoding) in house? No. (Although it would certainly mean job security for the readers of this website.)

There are ways to maintain the requisite privacy and still use online services. One method would be to create an account, get everything tested and figured out and then, using a temporary email address, set up a new account with an unrelated billing address associated with a credit card that can't be traced back to you. Processing the addresses on this account would theoretically not give away any valuable context and thus would maintain the privacy of the individuals on the list. (This is starting to sound like the movie Enemy Of The State.

If that sounds complex and unnecessary, I agree. A simpler method would be to take advantage of an API that uses HTTPS and POST and that doesn't store or log any of the data that you process. The use of HTTPS means that the only record would be a timestamp and the IP address that you call from. The underlying URL would not be known. Of course the account that you use would lead back to you BUT, that's not a problem because using a POST request allows you to attach a payload (in this case a batch of addresses) and the contents of the payload are not logged. Thus, the addresses that you submit are not on any server log. And the fact that they memory is wiped between each process means that those addresses aren't ever stored or logged and their transmission back to you is done over a secure connection. The end result is a log like this:

13Mar2012 06:31(-6) IP:12.134.223.12 UserID: 875564 -- POST QTY:3439942 -- [Processed]

Anyone that looks at the logs would see only that you processed some addresses and they would have no idea what addresses were processed. This satisfies even the strictest privacy policy requirements. It wouldn't make sense for me to point out that this type of service is available (and super fast) without mentioning where to find it. It's already built into the LiveAddress API service from SmartyStreets. Other services such as Cdyne, QAS, and ServiceObjects may also offer similar services but I haven't heard of any yet.

Answer 4

Possibly you could create an ID, split your table. Removing personally identifiable information. then rejoin the table after geocoding.

In the vein of (federated PCness) I suppose that you could prove that once you run the data on a server somewhere, then you did not maintain chain of custody.

I did find quite a bit of writing on the subject if you would like to follow...

Cloud possession and control

Electronic age possession and control

Google book

Legal implication of Cloud computing

If the enforcement is carried out to the letter-of-the-law, cloud computing could be completely shut out of government services.

Answer 5

No, you can geocode offline. If you are using online batch geocoders, how does converting addresses into geographic coordinates become a privacy issue? It would be more of an issue if everyone's name was included and publicized. As Brad mentions separate address with an ID and rematch it when addresses have been geocoded. Standard practice.

Answer 6

Geocoding is low risk Earlier this year we worked with some hospitals and this question came up. The geocoding service itself wasn't a big concern because we stripped all but ID and address from the data,used secure transfer (https) and the TOS our in-house geocoder specified privacy protections that were enough to meet their criteria.

Displaying Locations Annonymously is harder The trickier bit was displaying maps of sparse data while maintaining annonymonity. The first option the client asked for was to add a random "fudge" into each point so that that actual house location was obscured. The problem with this approach is that the size of the fudge required is quite large (1/2 mile or more) (what if someone lives on a farm) and the tendency of map users to take the point locations as accurate. We settled on aggregating the points displaying enough to be anonymous while still having a useful map. A norm from other industries we have worked in seems to be that the aggregation unit must have at least 7 to 10 records.

Answer 7

I don't know if this is new since the question was asked, but if anyone was wondering in the google maps api v3 you can use SSL (https). Also the privacy section of the NAACCR Best Practices Guide it does discuss these issues.

Answer 8

In Austria this would definitely be a privacy issue.

First of all: Health data is classified as sensitive and there is no doubt that it is not allowed to overhand it to any third parties without explicit agreement of the person which is related to that dataset.

Even if it is anonymized: It is possible to geocode this health data, but it is also possible to geocode publicly available Name-to-Address Registers (Phonebook) and to connect health data to persons living there, so addresses are also classified as personal data.

This leads to the result, that you'd not be allowed to geocode this dataset by sending it to a third party without explicitly asking your participants.

Answer 9

I presume you are geocoding it, and not making the results public? If so, then how would the cloud be aware of what that data represents?

Presumably you can also obfuscate any data that you geocode with random data hiding any inherent pattern that may exist.

Answer 10

Do you need an exact geocode or general area? You might be able to use just the postal code or partial postal code f

Answer 11

I work for a geocoding company (YAddress.net), and we have a large number of customers with stringent privacy requirements -- financial industry, healthcare, law, etc.

We address their privacy concerns in two ways:

1. Online data processing over SSL encrypted connections (prevents data snooping in transit), plus privacy agreements on our side. This is sufficient for some customers, but not for all.

2. For ultimate privacy, an on-site software deployment option, where geocoding takes place entirely on customer's premises and no data ever travels over the internet.

As the other commenters correctly noted, a postal address in itself is a public piece of information and without any contextual data (such as customer names, numbers, etc.) it does not represent any disclosure of anything. However, real life businesses operate in real life legal environments, where this line of reasoning may or may not stand in court. If privacy is a pressing concern, extra cost of an on-site solution may be well worth it to avoid the risk of potential legal complications down the road.