# Machine learning and genomics:
precision medicine vs. patient privacy

Chloe-Agathe Azencott
(1) MINES ParisTech, PSL Research University, CBIO–Centre for Computational
Biology,
F-75006 Paris, France
(2) Institut Curie, PSL Research University, F-75005 Paris, France
(3) INSERM, U900, F-75005 Paris, France
<EMAIL_ADDRESS>
###### Abstract

Machine learning can have major societal impact in computational biology
applications. In particular, it plays a central role in the development of
precision medicine, whereby treatment is tailored to the clinical or genetic
features of the patient. However, these advances require collecting and
sharing among researchers large amounts of genomic data, which generates much
concern about privacy. Researchers, study participants and governing bodies
should be aware of the ways in which the privacy of participants might be
compromised, as well as of the large body of research on technical solutions
to these issues. We review how breaches in patient privacy can occur, present
recent developments in computational data protection, and discuss how they can
be combined with legal and ethical perspectives to provide secure frameworks
for genomic data sharing.

##  1 Introduction

The last decades have seen a surge in the amount and diversity of data
collected to describe biological phenomena. This has opened the door to new
approaches in biomedical research, allowing us to use statistical and machine
learning approaches to objectively analyze observations and generate new
hypotheses.

The benefits of these “big data” approaches range from advances in basic
biology to computer-aided diagnosis. Among them, the promise of precision
medicine – tailoring care to the clinical, environmental and genetic
characteristics of the patient – is currently attracting a lot of interest,
both in scientific communities and among the general public.

Indeed, the differences in how patients experience the same disease, whether
in terms of risk, prognosis, or response to treatment, can be striking. Even
the most prescribed drugs for the most common conditions have very limited
efficacy [1]; however, this can be be explained in great part by genomic
differences between patients [2]. There is a lot of appeal, therefore, for
data analysis solutions that allow us to exploit genomic databases to
precisely pinpoint these differences.

###  1.1 Data-driven precision medicine

Early examples of the usage of genomic information in precision medicine
include the breast cancer drug trastuzumab (Herceptin), which dramatically
improves the prognosis of patients whose tumor overexpresses the HER-2 gene,
or the colon cancer drugs cetuximab (Erbitux) and panitumumab (Vectibix),
which have little effect on patients that have a mutation in the KRAS gene.
The computational analysis of genomic data makes it possible to systematize
such findings by finding genomic similarities among patients that exhibit the
same prognosis, or response to a treatment. However, while the number of
potentially relevant genomic measurements is very large (for example, tens of
thousands of proteins, hundreds of thousands of RNA transcripts, or millions
of single point mutations), they are typically collected on only thousands of
patients. In this setting, with many more variables than samples, statistical
difficulties arise [3]. Data sharing, which is the most efficient way of
increasing cohort sizes, and maximizes the utilization of each sample, is
therefore crucial to the development of this field.

It is also important to note that, because of the aforementioned challenges,
existing approaches for the analysis of genomic data sets are limited in
scope. There is a strong need to develop new statistical models and machine
learning procedures to address these challenges, and hence to facilitate
exploratory access to these data sets to computational biologists,
statisticians and machine learners.

To illustrate our overview of privacy issues in genomic data sharing, we will
focus here on genome-wide association studies, or GWAS. They are one of the
most prominent tools for detecting genetic variants correlated with an
observed trait, such as disease status or response to treatment.

They consist in collecting, for a large cohort of individuals, the variants
they exhibit across hundreds of thousands to several millions of single
nucleotide polymorphisms (SNPs), that is to say, individual locations across
the DNA where variations of a single nucleotide can occur. A trait of interest
(which can be binary, such as disease status, or continuous, such as age of
onset) is also recorded for each individual. Statistical tests are then run to
detect associations between the SNPs and the observed trait [4]. When the
phenotype is binary, it is common to use $\chi^{2}$ or Cochran-Armitage tests,
although they require the stringent assumptions that individuals come from a
genetically homogeneous population, that the variants act independently from
each other, and that no covariates such as age, sex, or environmental effects
need to be accounted for. Relaxing these assumptions is an active area of
statistical and machine learning research.

###  1.2 Patient privacy

While the potential scientific and social benefits of sharing genomic data are
strong, these data are particularly sensitive.

Indeed, the genomic sequence of an individual can be interpreted to discover
information that most consider private, from their ancestry to their ability
to metabolize certain drugs or the diseases they are more at risk of
developing. Moreover, genomic databases also hold sensitive clinical
information, such as disease status, comorbidities, or environmental factors
(which can include drug abuse or trauma).

In an era where data is sometimes touted as the new oil, there is a growing
need to keep personal data private without impeding the technological,
scientific and societal advances that will come from analyzing large data
sets. This obviously applies to genomic data, even more so because of several
specific features of these data. First, because our understanding of genetics
is still growing, it is yet unclear what information the genome of an
individual will reveal about them ten years from now. Second, genomic data
does not only pertain to the person it belongs to: it also contains
information, to some extent, about their family, or even about their ethnic,
geographic or linguistic population. Finally, genomic data cannot be revoked:
unlike a credit card that can be canceled once its number has been
compromised, the genome of an individual cannot be changed.

And indeed, genetic discrimination, that is, being treated differently because
you have, or are perceived to have, a particular genetic mutation, has been a
source of concern for over thirty years [6]. This concern was first addressed
in the Declaration of Bilbao [7], which in 1993 denounced all uses of genetic
information causing or leading to discrimination. Several laws have been
passed across the world since then to implement such limitations. Currently,
article 21 of the E.U. Charter of Fundamental Rights prohibits any
discrimination based on, among other grounds, genetic features [8]. In the US,
the Genetic Information Non-discrimination Act (GINA) [9] makes it illegal for
employers or health insurers to use genetic test results. In several states,
including California, GINA was later extended to other domains such as
housing, mortgage lending, or education. By contrast, the genetic test
information of Canadians was not protected until January 2018 [10].

In addition to laws regulating genetic discrimination, protection from
breaches of genomic privacy can be achieved through data protection
regulations. In the US, the Health Information Technology for Economic and
Clinical Health (HITECH [11]) act requires data custodians to implement
physical, administrative and technical solutions to appropriately protect
biomedical data. In the EU, the recently adopted General Data Protection
Regulation (GDPR) [12], which will shortly come into force across Member
States, aims at preventing discriminatory effects on the basis of, among other
causes, genetic or health status, and explicitly identifies genetic and
biometric data as sensitive. Paired with this regulation, the Network and
Information Security directive, which should be implemented in national laws
by April 2018, includes health databases among the critical IT systems for
which appropriate security measures to mitigate cybersecurity risks must be
taken.

In spite of these policies, and of the lack of evidence for the occurrence of
genetic discrimination, genetic privacy is still a cause for much concern
across the world [13, 14]. Indeed, the law does not cover all aspects of one’s
life that might be affected by genetic discrimination – for example, social
interactions. In addition, it is not because discrimination is illegal that it
does not occur [15]. It is therefore important to combine legal and ethical
frameworks with technical solutions. In this paper, we will focus on the
latest, and review the mathematical and computational tools that allow
researchers to share genomic data without compromising patient privacy. We
will start by reviewing the limitations of mere anonymisation. We will then
describe two mathematical models for data privacy, the first one based on data
suppression and the second on the addition of noise. Finally, we will outline
encryption protocols and cryptographic hardware solutions.

##  2 Anonymisation is not enough

Genomic data, like any other sensitive data, is anonymized before being
analyzed or shared. This means that unique identifiers such as names are
stripped from it. Hence a patient who has taken part in a study about
depression will not have her identity directly associated, in any database,
with disease status (she has severe depression), comorbidities (she also has
an anxiety disorder), environmental factors (she did drugs for ten years), or
disease susceptibilities (she has a mutation that increases her risk for
breast cancer).

However, anonymisation is not sufficient to guarantee unidentifiability. This
is due to so-called auxiliary information: suppose you know that 53-year-old
Jane was treated for colon cancer in 2016 at a given hospital. If your
database for that hospital shows only one record for a female patient of this
age for this pathology, you will know this record must be Jane’s.

This has made a number of attacks against genetic databases possible, such as
using genealogies built from public records to identify participants in
family-based studies [16], or assessing whether a given genotype is part of a
cohort summed up by allele frequencies [17, 18]. As a result, both the NIH and
the Wellcome Trust updated their data sharing policy to strongly restrict
access to individual genotypes and aggregate genotype frequency data [19].

Many additional research results have shown the limitation of anonymisation.
To give a few examples, [20] showed how to predict the values of a thousand
SNPs from easily available gene expression data, and how to re-identify
individuals in SNP databases using these SNPs only; [21] identified people’s
surnames from profiling short tandem repeats on the Y chromosome and querying
public genetic genealogy databases; and [22] initiated work on predicting
facial features from DNA sequences. More recently, the work of [23] on re-
identification based on the combination of low-quality predictions of physical
traits initiated a heated controversy [24, 25] on genomic data sharing.

In what follows, we will briefly review alternative approaches that provide
appropriate participant privacy while maximizing scientific impact, or
utility.

It should however be noted that genomes are the ultimate identifier: even if
your name has been removed from a genomic database, your genome can be
obtained from a drop of blood or some saliva. In this case, private
information encoded in your DNAcould be obtained directly. In addition, an
adversary could use your DNA to retrieve your record in a genomic database,
hence gaining access to auxiliary information. This type of attack, however,
requires physical access to a person’s biological sample and to sequencing
equipment. As such, it is much less scalable and, hence, worrying, than
computer attacks based on database cross-referencing.

##  3 Learning from obfuscated data

###  3.1 De-identification by data suppression

Preventing re-identification often requires stripping more than unique
identifiers from the data. As an illustration, consider that an estimated
$87\%$ of the U.S. population has a unique combination of date of birth,
gender, and zip code [26]. This made it possible to leverage voter
registration data to find the names of $84$ to $97\%$ of the $579$
participants to the Personal Genome Project who had listed these three pieces
of demographic information [27]. Such pieces of information, which can be
combined together to create a unique identifier, are called quasi-identifiers.

In the US, the Health Insurance Portability and Accountability Act (HIPAA)
therefore requires deleting not only names and phone numbers, but also
additional information such as the final digits of all zip codes, or vehicle
identifiers.

Unfortunately, some of the information that is destroyed can be crucial to a
particular study. For example, when studying drug side effects, one can be
interested in finding all cases where a rise in liver function tests followed
the beginning of treatment by no more than a few days – something that is not
possible if dates have been rounded to the month of year. On the other hand,
those guidelines are not sufficient to guarantee privacy in any database.
Formal data protection models have been proposed by computer scientists to
address these issues and quantify the notions of both utility and privacy.
Among those, $k$-anonymisation, which we detail below, seeks to release the
database, censored in such a way that re-identification is made almost
impossible.

###  3.2 $k$-anonymisation

$k$-anonymity, proposed by [29], seeks to prevent re-identification by
stripping enough information from the released data that any individual record
becomes indistinguishable from at least $(k-1)$ other records. For example,
let us consider a database in which zip code and age are quasi-identifiers.
While the three records {zip=47676, age=29, cancer=yes}, {zip=47677, age=26,
cancer=no} and {zip=47272, age=27, cancer=yes} are all distinct, releasing
them as {zip=47***, age=2*, cancer=yes}, {zip=47***, age=2*, cancer=no} and
{zip=47***, age=2*, cancer=yes} ensures they all belong to the same
equivalence class (i.e. the set of records that have the same identifying
information) and satisfies $3$-anonymity.

However, $k$-anonymity does not provide any control on the variability of
confidential but non-identifying attributes. In our example, it could very
well be that the three records all have the confidential cancer attribute set
to yes. In this case, a person matching any of these three records will be
known to have cancer, even though their exact record will not be identifiable.

Two variations on this framework, $l$-diversity [30] and $t$-closeness [31],
have therefore been proposed. More specifically, a database release is said to
satisfy $l$-diversity if any sensitive attribute has at least $l$ well-
represented values in any equivalence class. A database release is said to
satisfy $t$-closeness if the distance between the distribution of a sensitive
attribute within an equivalence class and its distribution within the entire
database is upper-bounded by $t$.

While $k$-anonymisation has been successfully applied to genomic sequences
[32] or to electronic medical records used for the validation of GWAS [33], it
is important to note that this model and its variants offer no formal privacy
guarantees. Indeed, because an adversary might have a greater level of
knowledge than initially assumed, the above argument about auxiliary
information still holds, and $k$-anonymisation is vulnerable against several
attacks [34]. One of these attacks, called a linkage attack, can be successful
when another public database has information that overlaps with a
$k$-anonymized data set. For example, the medical records of the governor of
Massachussetts were identified from crossing anonymized medical data with
public voter registration records. In addition, when the number of sensitive
variables is large, which is the case with genomic sequences and GWAS data,
they can only be achieved by deleting most of these variables, hence losing in
utility [35].

##  4 Learning from noisy data: differential privacy

Another formal data protection model, called differential privacy [36, 37],
was introduced to address the shortcomings of previous privacy models. In this
popular model, which was awarded the Gödel Prize in 2017, de-identification is
prevented by the addition of noise to the data. The model is based on the fact
that auxiliary information will always make it easier to identify an
individual in a dataset, even if anonymized. Instead, differential privacy
seeks to guarantee that the information that is released when querying a
database is nearly the same whether a specific person is included in the study
or not [36]. Unlike $k$-anonymity, differential privacy provides formal
statistical privacy guarantees.

More specifically, a query function $\psi$ is called $\epsilon$-differentially
private if, for any set $\mathcal{S}$ of possible answers, and for any two
databases $\mathcal{D}$ and $\mathcal{D}^{\prime}$ that differ by exactly one
sample, the probability that the answer to $\psi$ on $\mathcal{D}$ is in
$\mathcal{S}$ is $\epsilon$-close to the probability that the answer to the
same query is in the same set when $\mathcal{D}^{\prime}$ is queried:
$\mathbb{P}(\psi(\mathcal{D})\in\mathcal{S})\leq
e^{\epsilon}\;{\mathbb{P}(\psi(\mathcal{D}^{\prime})\in\mathcal{S})}.$

Both an interactive and a non-interactive settings can be considered. In a
non-interactive setting, an obfuscated version of the database is released.
Alternatively, only summary statistics are released, possibly after the
addition of noise. In an interactive setting, the database is not made public,
but users are allowed to query it, and it is the true answers to these queries
that are obfuscated by the injection of noise.

This noise injection obviously leads to somewhat inaccurate results. The goal
of differential privacy research is therefore to simultaneously maximize
utility (i.e. limit the inaccuracy of the results) and privacy (i.e. minimize
$\epsilon$). While $k$-anonymity and differential privacy are often opposed,
the latter having formal privacy guarantees but often lower utility than the
former, efforts are being made to bridge the gap between both privacy models
[38].

Unfortunately, in precision medicine applications, the dimensionality of the
data tends to be a major limitation to the utility of differentially private
mechanisms [39]. Nevertheless, recent work [40, 41, 42] has shown how to
implement differential privacy for GWAS, making it possible for users to query
a genetic database for the differentially private top $k$ most associated
SNPs. The results are approximate in the sense that the returned $p$-values
are exact only within an order of magnitude, and the exact location of the
SNPs might be off; however, these results are believed to be of sufficient
quality to drive further biomedical analyses.

A major drawback of these approaches, however, is that only a preset list of
queries (“return the $p$-value of a given SNP”, “return the location of the
top $k$ SNPs”) are allowed. This restricts the diversity of exploratory
analyses one might conduct on such data. In a field where statisticians and
machine learners are still proposing novel methods to get more informative
results from data, this is a strong limitation. There is still a strong need
for mechanisms for releasing a noisy version of the data, on which one can
efficiently get highly accurate answers from a variety of queries [43].

##  5 Working with encrypted genomic data

In the interactive differential privacy setup above, the data is only visible
to users as the distorted outcomes of authorized queries. However, the data
server itself is not immune to attacks. In addition, differential privacy
solutions are limited in that they result in noisy outcomes. There is
therefore a growing interest for using cryptographic protocols to share and
analyze biomedical data without revealing the contents of any particular
record. This goal is achieved while providing formal computational privacy
guarantees, which depends on how much computation is allowed on the server on
which the private data resides. The yearly competitions organized by the NIH-
funded national center for integrating data for analysis, anonymisation and
sharing (iDASH111http://www.humangenomeprivacy.org) are instrumental in the
development of privacy by encryption.

###  5.1 Homomorphic encryption

As cohort sizes grow, so does the interest for performing genomic analyses on
the cloud (as demonstrated, for example, by the Pan-Cancer Analysis of Whole
Genomes project [44]). Reliable technical solutions for securely outsourcing
genomic data analyses to remote servers are therefore necessary. Homomorphic
encryption is such a solution. It seeks to ensure that computation on
encrypted data yields a result which, once decrypted, matches the result you
would have gotten on the non-encrypted data. This makes it possible to entrust
a third party with the encrypted version of your data, knowing that they will
not be able to decrypt it, nor the results of your analyses.

Such a scheme could also be used to facilitate sharing genomic data that are
stored encrypted in the cloud. Arbitrary individuals can then query the
encrypted data; however, their answer is only decrypted (by an authority) if
their queries match a predefined allowable query policy [45].

Unfortunately, homomorphic encryption techniques only support a small number
of arithmetic operations on the data, and are demanding both in computational
time and in memory. Still, they have been successfully applied to searching
sequences of SNPs in large genomic databases [46]. It is also possible to
compute $\chi^{2}$ association tests for an entire GWAS data set over a
population of $10\,000$ patients in half a day [47], although the storage
costs of key generations can be high [48, 49]. A solution for rare variants
analysis, by means of an exact logistic regression model, has also been
proposed [50]. The computational and memory costs of homomorphic encryption
schemes are still several orders of magnitude larger than the equivalent
computation over non-encrypted data. In addition, the solutions that have been
proposed are tailored to a few specific analyses, and are far from covering
all existing methods for the analysis of GWAS data. They are therefore, at the
moment, of limited interest to the practitioner.

###  5.2 Secure multi-party computation

A common data sharing setup is that of collaborative analyses, in which
multiple institutions would like to join their data sets and all obtain the
results from queries on the combined data set. Setting up a platform where
genomic data can be stored and processed so that none of the individual
institutions can reconstruct the data reduces the risk of both inadvertent and
malicious leaks, hereby facilitating such a collaboration. This is the problem
that the field of secure multi-party computation addresses. This subfield of
cryptography aims at providing methods for multiple parties to jointly compute
a function over the union of their input data while keeping those inputs
private.

Secure multi-party computations were first introduced by Yao [51] for two
parties. Assuming two agents $A$ and $B$ each own data $\mathcal{D}_{A}$ and
$\mathcal{D}_{B}$, the goal is for both $A$ and $B$ to be able to compute a
function $f(\mathcal{D}_{A},\mathcal{D}_{B})$ without either of them learning
the data from the other. In this setting, the main approach is known as
garbled circuits, or Yao’s protocol. It requires encoding $f$ as a Boolean
function, or circuit, with fixed-length binary inputs. It is possible for $A$
to randomize (“garble”) the truth tables of the logical gates of $f$ into
$\hat{f}$, as well as her input $\mathcal{D}_{A}$ into
$\widehat{\mathcal{D}_{A}}$, in such a way that
$\hat{f}(\widehat{\mathcal{D}_{A}},\widehat{\mathcal{D}_{B}})=f(\mathcal{D}_{A},\mathcal{D}_{B})$.
$A$ transmits $\hat{f}$ and $\widehat{\mathcal{D}_{A}}$ to $B$, who also
obtains $\widehat{\mathcal{D}_{B}}$ from $A$ using oblivious transmission,
meaning that $A$ never learns $\mathcal{D}_{B}$ in the process. $B$ can then
reveal the output of
$\hat{f}(\widehat{\mathcal{D}_{A}},\widehat{\mathcal{D}_{B}})$ to $A$.

Multiple garbled circuit methods have been proposed to analyze genomic data,
in particular for computing similarities between sequences [52, 53] or for
case-control GWAS studies [54]. However, these approaches are limited to two-
party computations, meaning that they yet have to be adapted to the case where
more than two partners want to collaborate on a federated genomic study.

In contrast, secret sharing approaches to secure multi-party computations
guarantee that the database can only be reconstructed if $t$ out of the $n$
participants collude together.Here, all parties have a similar role (unlike
the sender $A$ and the receiver $B$ in garbled circuits), and the functions
are encoded are arithmetic circuits, meaning that instead of logical gates,
the circuits are composed of additions and multiplications.

Although current secret sharing solutions have strong limitations (for
example, floating-point and comparison operations are inefficient), they have
been successfully applied to GWAS data, both for association tests [55, 56]
and minor allele frequency computations [56]. In addition, [57] showed how to
account for differences in study design between the different institutes.

Although they apply to a different setting, these approaches are more
efficient than homomorphic encryption schemes. Unfortunately, they still have
limited flexibility, as specific circuits must be designed and optimized for
each task. In addition, they do not allow additional users to perform
computations on the data, which strongly limits their application to genomic
research.

###  5.3 Cryptographic hardware

Both homomorphic encryption and secure multi-party computations impose
significant computational overhead when compared to analyses over non-
encrypted data. In addition, the type of analyses that can be implemented
within these frameworks is limited. By contrast, solutions based on
cryptographic hardware do not significantly increase computational time, nor
do they severely limit the operations that can be executed on the data. They
are therefore an interesting avenue to make secure large-scale genetic
analyses feasible in practice.

Secure co-processors, or hardware security modules, are computational devices
that can be trusted to store data execute code securely, even against an
adversary who physically controls the host. A first example or their use in
genomics data processing is [58], in which secure co-processors were used to
securely query a genomic database for the number of samples matching a given
SNP pattern.

A more popular architecture is Intel Software Guard Extensions (SGX) [59]. It
extends the architecture of Intel x86 processor and allows for the creation of
private memory regions, in which code and data are isolated and protected from
external processes. This architecture makes it possible to allow untrusted
parties to remotely run computations on private data without compromising
them. SGX computations are several orders of magnitudes more efficient than
homomorphic encryption or secure multi-party computations. For example, [60]
leverages SGX to compute global transmission/disequilibrium test statistics
from allele counts transmitted by individual research centers having each
performed family studies, therefore enabling a real-world collaboration on
Kawasaki’s disease.

###  5.4 Protecting genomic databases

Data obfuscation and differential privacy aim at ensuring sensitive data is
not revealed from inferences drawn from the data that is released. Genomic
data encryptionsafeguards privacy in that the data that is stored is
encrypted; even in the case of direct attacks against the databases, keys are
needed to decrypt the data. Finally, computer security aims at ensuring that
only people with authority to receive information have access to it. While
neither computer security nor genomic data encryption deal with inferences
that can be drawn from answers to authorized queries, it is an important
aspect of safeguarding genomic data. Indeed, the HITECH act in the US and the
GDPR [12] in Europe are now requiring that genomic data custodians implement
physical, administrative and technical solutions to appropriately protect
biomedical data.

Encryption techniques such as homomorphic encryption, secure multi-party
computation, and the use of cryptographic hardware go a long way towards
achieving these goals. In addition, a growing interest for the blockchain
technology has driven a number of commercial initiatives [61, 62]. It is
important to note, however, that, on its own, a blockchain can only be used to
guarantee that only authorized actors can download a database. In other words,
these actors obtain access to the raw data. To increase both privacy and
utility, it will be desirable to limit the number of users who have access to
the raw data, while increasing the number of users who can query it. This
requires combining the blockchain mechanism with additional cryptographic or
differential privacy techniques.

##  6 Discussion

Protecting the privacy of all individuals who have their genome sequenced, or
other types of genomic data measured, is a concern of growing importance.
There is at the moment little evidence of actual cases of “genomic hacking”,
outside of the somewhat artificial conditions of re-identification
experiments. However, as genomic data become technically easier to acquire,
and as our ability to interpret them grows, it is not outlandish to expect
more occurrences of private genomic information leaks or genetic
discrimination. Nevertheless, while genomic data are highly sensitive, they
are also, thanks to machine learning and statistics, key to the progress of
healthcare and precision medicine. It is therefore important to accumulate
such data and devise ways for researchers to access them securely. To
guarantee that the scientific and social benefits of genomic data sharing
outweigh the potential pitfalls, regulators and scientists must work together
to develop appropriate sharing frameworks, based on ethical concerns and
technical solutions.

In agreement with [63], we propose to build our reflection around three
aspects. The first is algorithmic solutions to de-identification, that is to
say data (or query answer) obfuscation solutions. As we have seen,
$k$-anonymity and its derivatives are currently limited in the level of
privacy they can effectively guarantee for patients. Differential privacy,
which returns noisy answers to database queries, is a powerful alternative;
however its utility is limited by the need to return somewhat inaccurate
answers. In addition, the scope of queries that can be performed is narrow,
which currently limits the development of novel machine learning methods in
the context of differential privacy.

The second is database security. Cryptographic frameworks such as homomorphic
encryption or secure multi-party computation allow authorized users to perform
specific queries without ever accessing the data. In addition, because the
data is stored encrypted, it is also protected against direct attacks. While
these frameworks only allow limited types of requests at the cost of
significant computational and storage overheads, cryptographic hardware is
emerging as a much efficient way to perform secure and accurate analyses.

It is important to note that differential privacy and cryptography are
complementary techniques: in the first one, the guarantee of privacy is
statistical, and is degraded when the number of data queries increases, while
in the second, the guarantee of privacy is computational, and is degraded when
the server is allowed unbounded computations. Both approaches to data
protection are still in their infancy, particularly pertaining to the specific
challenges of genomic applications. Technical developments in these fields
should be pushed forwards to address the limitations we highlighted.

Finally, because unlike data obfuscation solutions, which are meant to let any
user access or query the data, cryptographic solutions only let authorized
users query the database, the third important front to consider is researcher
trust: who are the authorized users? Indeed, cryptographic solutions are
designed to only let data owners analyze their data, or a larger collection of
data they have contributed to. On the one hand, this circumvents the
significant resources associated with setting up a granting authority who
verifies whether researchers asking for data access are legitimate. On the
other hand, restricting the number of well-meaning researchers that can access
these databases strongly limits their potential impact. Data access
restrictions are a burden for researchers, particularly junior researchers or
small labs that do not have the clout to set up collaborations with major data
curators.

Several interesting ideas regarding trust have been discussed in recent years.
For example, [64] have demonstrated how to use game theory to devise optimal
policies to choose between (1) partial but unconditional data sharing and (2)
data usage agreements, complete with financial penalties in the event of a
breach of contract.

Another approach is to somewhat give up on the notion of privacy, by informing
study participants that, although appropriate measures will be taken to that
effect, their privacy cannot be guaranteed [65, 66]. Hence the “trust not
privacy” approach, which fits well in the emerging paradigm of so-called P4
(preventive, predictive, personalized and participatory) medicine, aims at
alleviating the concerns participants may have by involving them in the
research process. In essence, the knowledge that they are advancing science
compensates the potential drawbacks of their volunteerism. This can be
achieved by informing participants of the intended and actual use of their
data; giving them control over future use of their data; and informing them of
the outcomes of the studies they have participated in [67]. One could also
contemplate combining this vision with specific insurance policies against
privacy attacks for genomic studies participants.

It is important to point out that the issues we have discussed are not limited
to academic studies of genetic data. On the contrary, direct-to-consumer
genetics testing companies accumulate large amounts of genetic data, raising
potentially problematic issues in terms of the adequacy of the consumer’s
informed consent [68], in particular with respect to privacy issues. In
addition, although we have focused here on genomic data, increasing amounts of
non-genomic biomedical data are being accumulated from wearable medical
devices, fitness tracking devices, at-home sensors; and these potentially
sensitive data are not necessarily covered by existing legislation, nor the
focus of current privacy and cryptography research efforts.

To conclude, it is important to stress that the mechanisms of gene expression
and its regulation are complex. DNA alone does not determine behavior,
intelligence, or health. When it comes to complex traits, most effect sizes we
observe are very small, meaning that they can only be interpreted as small
risk increases. We must also remember that, even with advanced machine
learning techniques, there is a long way to go from statistical observations
to molecular mechanisms. In addition, current cohorts are predominantly white,
male, from developed countries; whether the findings apply to individuals from
other populations is unclear. This does not lower the value of genetic studies
for biomedical advances, as there is still a lot left to understand about the
role of our genome in diseases and responses to treatment. However this means
that potential actors in genetic discrimination should be educated about the
limited extent of the information one can learn about someone from their
genomic data. It is often the accompanying clinical data, such as disease
status, comorbidities or environmental factors, that can be the most damaging
when used wrongly.

The author declare that she has no competing interests.

The author would like to thank participants to discussions ensuing her talk on
a similar topic at the Machine Learning in Society Workshop at DALI 2016 in
Sestri Levante, Italy on April 1st, 2016.

## References

  * [1] Schork NJ. Personalized medicine: time for one-person trials. Nature. 2015;520(7549):609–611.
  * [2] Spear BB, Heath-Chiozzi M, Huff J. Clinical application of pharmacogenetics. Trends in Molecular Medicine. 2001;7(5):201–204.
  * [3] Donoho DL. High-dimensional data analysis: The curses and blessings of dimensionality. In: AMS Conference on Math Challenges of the 21st Century; 2000.
  * [4] Gondro C, Werf JVD, Hayes B, editors. Genome-Wide Association Studies and Genomic Prediction. New York: Humana Press; 2013.
  * [5] Ewens WJ, Spielman RS. The transmission/disequilibrium test: history, subdivision, and admixture. Am J Hum Genet. 1995;57(2):455–464.
  * [6] Matthewman WD. Title VII and genetic testing: Can your genes screen you out of a job. Howard Law Journal. 1984;27:1185.
  * [7] International Workshop on Legal Aspects of the Human Genome Project (Bilbao, 24-26 May 1993) Adopts Bilbao Declaration; 1994.
  * [8] Charter of Fundamental Rights of the European Union Article 21 - Non-discrimination; 2000.
  * [9] Title II of the Genetic Information Nondiscrimination Act of 2008 (GINA); 2008.
  * [10] Genetic Non-Discrimination Act - Parliament of Canada; 2017. s-201.
  * [11] American Recovery and Reinvestment Act; 2009. public Law 111-5.
  * [12] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ; 2016.
  * [13] Green RC, Lautenbach D, McGuire AL. GINA, genetic discrimination, and genomic medicine. New England Journal of Medicine. 2015;372(5):397–399.
  * [14] Wauters A, Van Hoyweghen I. Global trends on fears and concerns of genetic discrimination: a systematic literature review. J Hum Genet. 2016;61(4):275–282.
  * [15] Quillian L, Pager D, Hexel, O, Midtbøen, A H. Meta-analysis of field experiments show no change in racial discrimination over time. PNAS. 2017;114(41):10870–10875.
  * [16] Malin B. Re-identification of familial database records. AMIA Annual Symposium Proceedings. 2006;2006:524–528.
  * [17] Homer N, Szelinger S, Redman M, Duggan D, Tembe W, et al. Resolving individuals contributing trace amounts of DNA to highly complex mixtures using high-density SNP genotyping microarrays. PLOS Genet. 2008;4(8):e1000167.
  * [18] Wang R, Li YF, Wang X, Tang H, Zhou X. Learning your identity and disease from research papers: information leaks in Genome Wide Association Study. In: Proceedings of the 16th ACM Conference on Computer and Communications Security. New York, NY, USA; 2009. p. 534–544.
  * [19] NIH. Policy for sharing of data obtained in NIH supported or conducted Genome-Wide Association Studies (GWAS); 2007.
  * [20] Schadt EE, Woo S, Hao K. Bayesian method to predict individual SNP genotypes from gene expression data. Nature Genetics. 2012;44(5):603–608.
  * [21] Gymrek M, McGuire AL, Golan D, Halperin E, Erlich Y. Identifying personal genomes by surname inference. Science. 2013;339(6117):321–324.
  * [22] Claes P, Liberton DK, Daniels K, Rosana KM, Quillen EE, Pearson LN, et al. Modeling 3D facial shape from DNA. PLOS Genetics. 2014;10(3):e1004224.
  * [23] Lippert C, Sabatini R, Maher MC, Kang EY, Lee S, Arikan O, et al. Identification of individuals by trait prediction using whole-genome sequencing data. PNAS. 2017;p. 201711125.
  * [24] Erlich Y. Major flaws in ’Identification of individuals by trait prediction using whole-genome’. bioRxiv. 2017;p. 185330.
  * [25] Lippert C, Sabatini R, Maher MC, Kang EY, Lee S, Arikan O, et al. No major flaws in ’Identification of individuals by trait prediction using whole-genome sequencing data’. bioRxiv. 2017;p. 187542.
  * [26] Sweeney L. Simple demographics often identify people uniquely. Carnegie Mellon University; 2000. 3.
  * [27] Sweeney L, Abu A, Winn J. Identifying participants in the Personal Genome Project by name. Rochester, NY: Social Science Research Network; 2013. ID 2257732\.
  * [28] Office for Civil Rights. Methods for de-identification of PHI; 2012.
  * [29] Sweeney L. k-Anonymity: a model for protecting privacy. Int J Uncertain Fuzziness Knowl-Based Syst. 2002;10(5):557–570.
  * [30] Machanavajjhala A, Kifer D, Gehrke J, Venkitasubramaniam M. l-Diversity: privacy beyond k-anonymity. ACM Trans Knowl Discov Data. 2007;1(1).
  * [31] Li N, Li T, Venkatasubramanian S. t-Closeness: privacy beyond k-anonymity and l-Diversity. In: IEEE 23rd International Conference on Data Engineering, 2007. ICDE 2007; 2007. p. 106–115.
  * [32] Li G, Wang Y, Su X. Improvements on a privacy-protection algorithm for DNA sequences with generalization lattices. Computer Methods and Programs in Biomedicine. 2012;108(1):1–9.
  * [33] Loukides G, Gkoulalas-Divanis A, Malin B. Anonymization of electronic medical records for validating genome-wide association studies. Proceedings of the National Academy of Sciences. 2010;107(17):7898–7903.
  * [34] Clifton C, Tassa T. On syntactic anonymity and differential privacy. In: 2013 IEEE 29th International Conference on Data Engineering Workshops (ICDEW); 2013. p. 88–93.
  * [35] Aggarwal CC. On k-anonymity and the curse of dimensionality. In: Proceedings of the 31st International Conference on Very Large Data Bases. Trondheim, Norway: VLDB Endowment; 2005. p. 901–909.
  * [36] Dwork C. Differential privacy. In: Automata, Languages and Programming. No. 4052 in Lecture Notes in Computer Science. Springer Berlin Heidelberg; 2006\. p. 1–12.
  * [37] Nissim K, Steinke T, Wood A, Altman M, Bembenek A, Bun M, et al. Differential privacy: a primer for a non-technical audience; 2017.
  * [38] Soria-Comas J, Domingo-Ferrer J, Sánchez D, Martínez S. Enhancing data utility in differential privacy via microaggregation-based k-anonymity. The VLDB Journal. 2014;23(5):771–794.
  * [39] Fredrikson M, Lantz E, Jha S, Lin S, Page D, Ristenpart T. Privacy in pharmacogenetics: an end-to-end case study of personalized warfarin dosing. In: 23rd USENIX Security Symposium; 2014. p. 17–32.
  * [40] Johnson A, Shmatikov V. Privacy-preserving data exploration in Genome-wide Association Studies. In: Proceedings of the 19th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM; 2013\. p. 1079–1087.
  * [41] Yu F, Ji Z. Scalable privacy-preserving data sharing methodology for genome-wide association studies: an application to iDASH healthcare privacy protection challenge. BMC Medical Informatics and Decision Making. 2014;14(1):S3.
  * [42] Simmons S, Berger B. Realizing privacy preserving genome-wide association studies. Bioinformatics. 2016;32(9):1293–1300.
  * [43] Dankar FK, El Emam K. The application of differential privacy to health data. In: Proceedings of the 2012 Joint EDBT/ICDT Workshops. EDBT-ICDT ’12. New York, NY, USA: ACM; 2012. p. 158–166.
  * [44] Molnár-Gábor F, Lueck R, Yakneen S, Korbel JO. Computing patient data in the cloud: practical and legal considerations for genetics and genomics research in Europe and internationally. Genome Medicine. 2017;9:58.
  * [45] Lauter K, López-Alt A, Naehrig M. Private computation on encrypted genomic data. In: Progress in Cryptology - LATINCRYPT 2014. Lecture Notes in Computer Science. Springer, Cham; 2015. p. 3–27.
  * [46] Shimizu K, Nuida K, Rätsch G. Efficient privacy-preserving string search and an application in genomics. Bioinformatics. 2016;32(11):1652–1661.
  * [47] Lu WJ, Yamada Y, Sakuma J. Privacy-preserving genome-wide association studies on cloud environment using fully homomorphic encryption. BMC Medical Informatics and Decision Making. 2015;15(5):S1.
  * [48] Zhang Y, Dai W, Jiang X, Xiong H, Wang S. FORESEE: Fully Outsourced secuRe gEnome Study basEd on homomorphic Encryption. BMC Medical Informatics and Decision Making. 2015;15(5):S5.
  * [49] Kim M, Lauter K. Private genome analysis through homomorphic encryption. BMC Medical Informatics and Decision Making. 2015;15(5):S3.
  * [50] Wang S, Zhang Y, Dai W, Lauter K, Kim M, Tang Y, et al. HEALER: homomorphic computation of ExAct Logistic rEgRession for secure rare disease variants analysis in GWAS. Bioinformatics. 2016;32(2):211–218.
  * [51] Yao ACC. How to generate and exchange secrets. In: Proceedings of the 27th Annual Symposium on Foundations of Computer Science. SFCS ’86. Washington, DC, USA: IEEE Computer Society; 1986. p. 162–167.
  * [52] Jha S, Kruger L, Shmatikov V. Towards practical privacy for genomic computation. In: Proceedings of the 2008 IEEE Symposium on Security and Privacy. SP ’08. Washington, DC, USA: IEEE Computer Society; 2008. p. 216–230.
  * [53] Wang XS, Huang Y, Zhao Y, Tang H, Wang X, Bu D. Efficient Genome-Wide, privacy-preserving similar patient query based on private edit distance. In: Proceedings of the 22Nd ACM SIGSAC Conference on Computer and Communications Security. CCS ’15. New York, NY, USA: ACM; 2015. p. 492–503.
  * [54] Constable SD, Tang Y, Wang S, Jiang X, Chapin S. Privacy-preserving GWAS analysis on federated genomic datasets. BMC Medical Informatics and Decision Making. 2015;15(5):S2.
  * [55] Kamm L, Bogdanov D, Laur S, Vilo J. A new way to protect privacy in large-scale genome-wide association studies. Bioinformatics. 2013;29(7):886–893.
  * [56] Zhang Y, Blanton M, Almashaqbeh G. Secure distributed genome analysis for GWAS and sequence comparison computation. BMC Medical Informatics and Decision Making. 2015;15(5):S4.
  * [57] Xie W, Kantarcioglu M, Bush WS, Crawford D, Denny JC, Heatherly R, et al. SecureMA: protecting participant privacy in genetic association meta-analysis. Bioinformatics. 2014;30(23):3334–3341.
  * [58] Canim M, Kantarcioglu M, Malin B. Secure management of biomedical data with cryptographic hardware. IEEE Transactions on Information Technology in Biomedicine. 2012;16(1):166–175.
  * [59] Anati I, Gueron S, Johnson SP, Scarlata VR. Innovative technology for CPU based attestation and sealing; 2013.
  * [60] Chen F, Wang S, Jiang X, Ding S, Lu Y, Kim J, et al. PRINCESS: Privacy-protecting Rare disease International Network Collaboration via Encryption through Software guard extensionS. Bioinformatics. 2017;33(6):871–878.
  * [61] Gene Blockchain Platform. Gene blockchain whitepaper; 2017.
  * [62] Grishin D, Obbad K, Estep P, Cifric M, Zhao Y, Church G. Blockchain-enabled genomic data sharing and analysis platform; 2018.
  * [63] Murphy SN, Gainer V, Mendis M, Churchill S, Kohane I. Strategies for maintaining patient privacy in i2b2. Journal of the American Medical Informatics Association: JAMIA. 2011;18 Suppl 1:i103–108.
  * [64] Wan Z, Vorobeychik Y, Xia W, Clayton EW, Kantarcioglu M, Malin B. Expanding access to large-scale genomic data while promoting privacy: a game theoretic approach. American Journal of Human Genetics. 2017;100(2):316–322.
  * [65] Lunshof JE, Chadwick R, Vorhaus DB, Church GM. From genetic privacy to open consent. Nature Reviews Genetics. 2008;9(5):406–411.
  * [66] Ball MP, Thakuria JV, Zaranek AW, Clegg T, Rosenbaum AM, et al. A public resource facilitating clinical use of genomes. Proceedings of the National Academy of Sciences. 2012;109(30):11920–11927.
  * [67] Erlich Y, Narayanan A. Routes for breaching and protecting genetic privacy. Nature reviews Genetics. 2014;15(6):409–421.
  * [68] Niemiec E, Howard HC. Ethical issues in consumer genome sequencing: Use of consumers’ samples and data. Applied & Translational Genomics. 2016;8:23–30.