<?xml version="1.0"?>
<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Publishing DTD v1.2 20190208//EN" "JATS-journalpublishing1.dtd"[]>
<article xml:lang="en" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:mml="http://www.w3.org/1998/Math/MathML" dtd-version="1.2" article-type="research-article">
<front>
<journal-meta>
<journal-id journal-id-type="publisher-id">IJPDS</journal-id>
<journal-title-group>
<journal-title>International Journal of Population Data Science</journal-title>
<abbrev-journal-title>IJPDS</abbrev-journal-title>
</journal-title-group>
<issn pub-type="epub">2399-4908</issn>
<publisher>
<publisher-name>Swansea University</publisher-name>
</publisher>
</journal-meta>
<article-meta>
<article-id pub-id-type="doi">10.23889/ijpds.v11i5.3614</article-id>
<article-id pub-id-type="publisher-id">11:5:3614</article-id>
<article-id pub-id-type="pii">S2399490821036144</article-id>
<article-categories>
<subj-group subj-group-type="heading">
<subject>Population Data Science</subject>
</subj-group>
</article-categories>
<title-group>
<article-title>Enhancing Safety in Distributed Analytics: A Framework for Assessing and Reducing Privacy Risk</article-title>
</title-group>
<contrib-group>
<contrib contrib-type="author"><name><surname>Domingue</surname><given-names initials="M">Marie-Pier</given-names></name><xref ref-type="aff" rid="affil-1"><sup>1</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Morissette</surname><given-names initials="J">Jean-Philippe</given-names></name><xref ref-type="aff" rid="affil-2"><sup>2</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Lévesque</surname><given-names initials="S">Simon</given-names></name><xref ref-type="aff" rid="affil-1"><sup>1</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Burgun</surname><given-names initials="A">Anita</given-names></name><xref ref-type="aff" rid="affil-3"><sup>3</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Lemyre</surname><given-names initials="FC">Félix Camirand</given-names></name><xref ref-type="aff" rid="affil-2"><sup>2</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Whyte</surname><given-names initials="C">Carrie-Anne</given-names></name><xref ref-type="aff" rid="affil-4"><sup>4</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>McGrail</surname><given-names initials="K">Kim</given-names></name><xref ref-type="aff" rid="affil-5"><sup>5</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Ethier</surname><given-names initials="JF">Jean-François</given-names></name><xref ref-type="aff" rid="affil-2"><sup>2</sup></xref></contrib>
<aff id="affil-1"><label>1</label><institution>Groupe de recherche interdisciplinaire en informatique de la santé (GRIIS), Sherbrooke, Canada; Institut Imagine, Université Paris Cité, Paris, France</institution></aff>
<aff id="affil-2"><label>2</label><institution>Groupe de recherche interdisciplinaire en informatique de la santé (GRIIS), Sherbrooke, Canada</institution></aff>
<aff id="affil-3"><label>3</label><institution>Institut Imagine, Université Paris Cité, Paris, France; Necker Hospital, AP-HP, Paris, France</institution></aff>
<aff id="affil-4"><label>4</label><institution>Canadian Institute for Health Information, Ottawa, Canada</institution></aff>
<aff id="affil-5"><label>5</label><institution>HDRN Canada, Vancouver, Canada</institution></aff>
</contrib-group>
<pub-date date-type="pub" publication-format="electronic"><day></day><month></month><year></year></pub-date>
<pub-date date-type="collection" publication-format="electronic"><year></year></pub-date>
<volume>11</volume>
<issue>5</issue>
<elocation-id>3614</elocation-id>
<permissions>
<license license-type="open-access" xlink:href="https://creativecommons.org/licenses/by-nc-nd/4.0/">
<license-p>This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.</license-p>
</license>
</permissions>
<self-uri xlink:href="https://ijpds.org/article/view/3614">This article is available from the IJPDS website at: https://ijpds.org/article/view/3614</self-uri>
<abstract>
<p>Distributed analytics enables analyses to be conducted when data is partitioned across multiple sites and cannot be pooled in one location. The primary motivation for using these methods is to protect confidentiality of line-level data. Distributed analytics methods rely on exchanging intermediate numerical outputs generated locally at each participating site. However, the absence of line-level data exchange should not be mistaken for privacy protection. To address this, the GRIIS developed a framework for evaluating privacy, helping users distinguish different levels of privacy preservation when applying distributed methods. This work was especially important, as earlier research demonstrated that an existing distributed method could be reverse-engineered to recover line-level data, which underscores that the distributed nature of an approach does not guarantee data privacy. In the framework, we define data privacy as guaranteed if line-level data cannot be uniquely recovered from the numerical outputs exchanged or disclosed during the execution of the approach. By eliciting line-level data as a set of unknown variables subject to constraints derived from the procedure, we can, in some settings, mathematically prove that privacy is protected under this definition. Achieving this depends on the nature of the variables included (binary, continuous), the results shared at the end of the procedure and the availability of external information. Ultimately, this work plays a critical role in supporting the responsible use of distributed analytics. By establishing governance mechanisms to evaluate and mitigate privacy risks, it helps ensure that these methods can be adopted appropriately and at scale across the country.</p>
</abstract>
</article-meta>
</front>
</article>