It's for the benefit of patients, and this raw data is already available, but under a loose NDA for commercial partners and researchers...
And of course raw data like this could benefit patients, but keeping access to raw data limited also benefits patients. Sure, the data is readily available under a loose NDA, but it's available to people who have explicit knowledge of the requirements around handling sensitive, identifiable data. Average Joe's and Jane's do not have this knowledge, and bad actors just plain don't give a shit.
The fact that you poo-poo this question is telling. Preventing re-identification attacks is incredibly subtle and sometimes impossible. Removing "city and date of birth" is nowhere near sufficient.
> this raw data is already available, but under a loose NDA for commercial partners and researchers...
Yes. It's available to people who have their real identities tied to their access and can be sued into oblivion or possibly even prosecuted for wanton misuse of the data. Surely you see how this is different from throwing it on a public s3 bucket, right?
It reminds me the FDA saying they can't release the COVID-19 documents because reviewing 44'000 documents would take 50 years.
It didn't take 50 years to produce them...
Yes there is some effort needed to anonymize reasonably the data but it's not an impossible task. It's a question of motivation.
Here, clearly, the labs and administration don't really want to put efforts into that.
And, yes, I think public data on this sort of stuff is important and should be properly resourced.
I think:
Step 1. ASK PERMISSION before changing the way data is handled.
Step 2. Share full datasets more generously, but still gated by use and handling agreements. This probably means a private citizens without ethics research training and a supporting it dept can’t get a copy and peruse it on their personal laptop, but also that a truly enormous number of researchers would be able to access the data.
The gold standard of a CSV in a public s3 bucket shouldn’t be the enemy of good enough.
And no, this isn’t under a “loose” NDA. This would be covered by HIPAA, which tends to be un-subtle about violations.
0 - https://www.cs.princeton.edu/~arvindn/publications/de-anonym...
Isn't that provably untrue? https://bits.blogs.nytimes.com/2015/01/29/with-a-few-bits-of...