This pisses me off. I don’t want any of my financial firms handing out my data to anyone. It looks like they even gave them demographic information specific enough to likely be identifiable. What firm is this data from? This should be illegal.
I don’t know if I can assuage your concerns but…
- any project like this goes through layers of lawyers on both sides (mit and the brokerage). They are extremely careful about exactly your concern.
- mit has infrastructure to securely hold data. They do a ton of defense work, for example. They take it seriously. In the non-defense context, accidentally exposing certain health data can (iirc) lead to the entire university losing eligibility for NIH funding. At MIT that might be a half billion dollar hit. They don’t mess around with that. (Compare to the private sector where there are effectively no meaningful fines or consequences for data breaches.)
- none of the researchers care about you as an individual enough to try to deidentify you in the data. I work with health data, some of which includes addresses. I have never thought for even one second that I should find out who lives at the address, even when dealing with data which includes the city I live in (so potentially my neighbors, eg.)
- everyone involved in the project also separately promises not to de-identify anyone. Again: I really doubt anyone I have ever met in my field would care identify someone, but we do promise not to.
- any data which is going to be merged with whatever the researchers got from the brokerage will be outlined in great detail in advance.
As another point of comparison, how many breaches of university research data are you aware of? These things happen in the corporate world all the time with extremely sensitive data but I have not heard of university data beaches myself.
Finally, there is generally some scientific benefit to the work that the researchers do. We know something from this paper about panic selling which we didn’t know before. That may be valuable.
Research ethics 101: Don’t use people as lab specimens unless they affirmatively consent. Period.
We should go back to the days of actual ethics in research.
Banks and brokerages can do whatever they want with customer data, subject to relevant laws and contracts. Researchers who ever want a penny from the public should be held to higher ethical standards.
Corps can put whatever they want in tos, and researchers are free to use data from those corps. But federal agencies should refuse to fund those pis and their institutions.
This is (and has always been) waivable in cases (like this one) where either obtaining consent is impractical (which maybe applies here) OR you are making use of de-identified data (more likely to apply in this case). Affirmative consent still is required in many cases.
With health data (the case I know personally), it would not be feasible for me to find five million patients and ask them to participate in my boring study answering a question which wouldn’t interest them. Just mailing each of them a letter to ask would be cost prohibitive!
The value of research is frequently non-zero, whereas the risk to the participants is generally zero or extremely low. This is the balance the IRB is trying to strike.
And believe me, as someone who has gone through it, I think they err way way WAY too far on the side of being overly cautious!
Nearly every large organization has probably had a data breach, the only questions are if it was discovered and if so if it was reported. MIT can have the best cybersecurity team in the world and they will still be helpless against a 0-day.
“None of the researchers care about you” - strawman, no one said that or thinks that, and it’s irrelevant.
“Everyone involved promises not to identify anyone” - see response to first point.
I think the other points are valid though.
They legally promise via some form a non-disclosure agreement. A violation means they are liable in the case they are the source of a breach, which can both provide incentives and recourse. Certainly not ironclad, but it is stronger than just a vague "promise."
First you have to care enough to go after the NDA breaker. Then you have to have enough evidence to legally demonstrate they broke the NDA. Then you have to pursue legal action. This all costs time and money, and even then there's a good chance you can't actually prove anything.
You have to seriously piss off someone (most likely a large corporation) with a lot of time and money for it to matter that you broke an NDA.
OP said he didn’t want to be de-anonymized. Either the researchers do that themselves or the data is stolen and someone else does it. For the first group, I tried to explain why the researchers themselves aren’t going to and why.
So I’m not sure no one thinks it and it’s not irrelevant.
> Either the researchers do that themselves
Has anyone suggested that? I don’t think anyone is concerned about the motives of MIT researchers.
Until you become a public figure with the wrong set of opinions, maybe.
While I'm sure there was a lot of attention on data security behind the scenes it is a little unnerving to hear someone say, when you aren't expecting it, "we looked at everyone's brokerage history and here's when they felt fear that they were about to lose everything."
I do wish there was a way to at least reduce the surprise factor. Perhaps put a note about the data collection protocol in the abstract on the article page.
Good security in one group does not mean good security in another group - at all.
Few people have any interest in finding out "who that person with cancer in that small town is", but "who is that unknown multi-millionaire in my parents' village" might be more tempting.
There's no political issue around individual health issues, but individual wealth is very political. I can definitely understand why someone wouldn't want identifiable information about their personal wealth given to third parties, especially not to US universities, which have a tendency to be rather left-wing and full of ideas of undeserved privilege that many don't share and would not feel comfortable knowing that their private information is shared with them. An angry research or student taking to Twitter to call out the evil capitalists isn't that crazy of an idea.