It is in the news that UK NHS patients will not be given the option of whether their medical data is processed by US spy tech firm Palantir. This is being justified by because their data will be anonymised before it is shared.

I have done a little work on anonymisation in biomedical research, and it is a difficult problem. The data a biomedical researcher is interested in is usually inherently personal and identifying, at least in the GDPR sense of the word in that it can be used with other data to identify an individual. There is always a tradeoff between the utility of the data and the risk of deanonymisation. This paper (or avoiding the paywall) gives an idea of the maths that can be applied to this problem to define the extent of the risk of individual personal data exposure.

Has the method and parameters used for anonymising NHS data before it is sent to Palantir been published? Is the likely or acceptable risk of deanonymisation quantified?

1 Answer 1


Frame challenge, the method used for anonymsing the data is not really the relevant part if you want to judge the risk of deanonymisation. The relevant question is how much and which data about individuals is in the data set.

I don't know exactly what is in the UK data base but I will give an example of a German data base. It contains all medical diagnoses of a significant proportion of the German population. It is anynomised, both patients and doctors are just numbers in the data base. But it also contains the birth date and the postal code of every patient. Now a double digit percenage of all people are uniquely identified by the combination of their birth date and their postal code. That is were the risk of deanonynomisation lies.

So the quality of the anonymisation procedure is fairly irrelevant. If they are not utterly incompentent, the risk of brute force deanonymisation is practially nil and can be mathematically proven to be. Deanonymisation happens if you have too detailed information about the data subjects.

  • 1
    I don't know whether looking at whether people are uniquely identified by some combination of data is the right approach. Many or most large datasets about human beings will have enough relevant factors that nearly every person is associated with some unique combination of those factors. The question is whether that set of unique factors can be traced back to something like a name.
    – Obie 2.0
    Commented Nov 22, 2023 at 19:55
  • 1
    @Obie2.0 For some large set of factors this can happen but the scenario here can happen quite quickly. All I need is holding your ID (for example German Personalausweis) which has your address and birth date on it and then I can look up all your health care data. It is also not that farfetched to get the birthdate and address of some random VIP or public personality and then be able to access all their health care data. It does happen only in that direction though, starting at the data base, IDing a particular person is hard.
    – quarague
    Commented Nov 23, 2023 at 7:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .