The complexities and guises of anonymity: privacy-enhancing technologies and medical AI

Abstract

As investment in artificial intelligence (AI) grows, so too do debates about how to enable the secondary use of patient data to train AI models. Privacy-enhancing technologies (PETs) such as synthetic data, federated learning, and Secure Data Environments (SDEs) have been put forward as technical solutions to facilitate this process, typically through the anonymisation of data. However, this article argues that there is misplaced emphasis on the value of PETs for anonymisation, overlooking the ‘complexities and guises’ of anonymising data for developing medical AI. Instead, PETs serve a more valuable role in health data sharing for medical AI within the scope of data protection laws by acting as risk-mitigating measures in the legitimate interest balancing test and serving as safeguards for research-related processing. This article discusses PETs in the context of the UK in light of recent changes to data protection laws and investment in new health data sharing infrastructures.