FIELD

The presently disclosed subject matter relates to a method for anonymizing a genomic data set and a corresponding system for anonymizing a genomic data set. The presently disclosed subject matter further relates to a computer-readable medium.

BACKGROUND

Whole genome sequencing is getting cheaper and cheaper, and services like 23andMe and Ancestry DNA offer to sequence hundreds of thousands of SNPs for prices around $100. However, as so much genomic information becomes available, concerns for privacy and security grow. Adversaries are increasingly able to combine genotypic and phenotypic information in a variety of ways to de-anonymize genomic databases. An identification attack, for example, is an attack in which the adversary attempts to identify the genotype (among multiple genotypes) that corresponds to a given phenotype. A further type of de-anonymization attack is the perfect matching attack, where the adversary attempts to match multiple phenotypes to their corresponding genotypes. Statistical models may also be used by an adversary to predict phenotypic traits, based on whole-genome sequencing data. Because of current advancements in genomics, the risk of identification of a subject using their genomic data is growing rapidly.

Quasi-identifiers, also known as indirect identifiers, are fields in a dataset that can be used in combination with one another to identify individuals. Examples include gender, zip code, birth date, profession and income. While there are many people who share the same gender, birth date or ZIP code, the combination of these for any one person may be unique, particularly if that person resides in a rural area with a small population. Examples of indirect identifiers include phenotypic traits, such as hair color and eye color, among many others.

Currently, whole genome sequences can be easily connected to phenotypic traits, making it possible to find out eye color, hair color, skin color, blood type, and the like, and subsequently identify the subject. As progress is made in genomic research, this problem will worsen. Often, users and researchers choose one of these two options: keep all genomic information intact, thereby risking a privacy breach, or remove all potentially identifiable information from the dataset, which limits the usefulness of the data. Published US patent application US 2020/0035332 Al describes methods and systems for anonymizing genetic data. The methods and systems described therein identify ancestry identification marker (AIM) regions in the genetic data. The AIM regions of the genetic data includes single nucleotide polymorphism (SNP) alleles associated with a population of patients belonging to a certain ancestry. AIM regions which do not contain gene variants associated with a specific disease may then be masked or removed from the genetic data.

A problem of the prior art is that there is no guarantee that the resulting genetic data is sufficiently anonymized. Merely masking or removing AIM regions without clinically relevant data may, in some cases, still result in a genetic data set which can reidentify the person. Moreover, the approach of the prior art involves removing data which may contribute in some as-yet unknown way to a particular disease, meaning that there is a possibility that useful information may be lost.

Removing more data from the genetic data set increases the risk of losing valuable and relevant information, thereby reducing the usefulness of the data, but preserving more data in the genetic data set increases the risk of the individual being reidentified from their genetic data set. There is therefore an advantage to being able to ensure that the genetic data set is sufficiently anonymized whilst preserving as much information as possible for applications such as research. Quantifying a risk of reidentification and ensuring that the risk that a person can be re-identified from an anonymized genomic data set can therefore improve patient privacy, security, and the amount of information available to researchers in an anonymized genomic data set.

SUMMARY

It would be advantageous to preserve as much genomic data as possible for researchers to access, whilst also protecting the privacy and security of the individuals whose data is used. A system and computer-implemented method for anonymizing a genomic data set are set out herein and are claimed. Said system and computer- implemented method aim to address these and other concerns.

Existing methods for genomic data preparation either remove important research information from the genomic data set, for example by removing all genomic data relating to visible phenotypic traits regardless of whether said genomic data also relates to a disease of interest, thereby reducing the amount of knowledge that can be gained from its analysis, or preserve too much identifying information of the individual, risking security and privacy breaches.

The presently disclosed subject matter includes a computer-implemented method for anonymizing a genomic data set, a system for anonymizing a genomic data set and a computer-readable medium. The method for anonymizing a genomic data set may comprise receiving the genomic data set. The genomic data set may comprise a plurality of alleles arranged in a plurality of single nucleotide polymorphisms (SNPs), the plurality of SNPs comprising one or more phenotype informative SNPs. A phenotype informative SNP may be an SNP which relates to a phenotypic trait. The genomic data set may correspond to a genome of a person. The method may further comprise obtaining a phenotypic probability for at least one phenotype informative SNP. The phenotypic probability may be a probability of the phenotypic trait being expressed as a result of the at least one allele corresponding to the at least one phenotype informative SNP. For example, if the phenotypic trait is “blue eyes”, the phenotypic probability may be the probability that the alleles occupying a particular phenotype informative SNP associated with eye color will result in the presentation of blue eyes. The method may further comprise obtaining a proportion of a population which exhibits said phenotypic trait. For example, if the phenotypic trait is “blue eyes”, the proportion of the population would correspond to the proportion of the population having blue eyes. The method further comprises computing a re-identification risk score based on the genomic data set. The reidentification risk score indicates a risk of re-identifying the person associated with the genomic data set from the genomic data set. The re-identification risk score may be computed from the obtained phenotypic probability and the obtained proportion of the population which exhibits said phenotypic trait. The re-identification risk score may then be compared to a threshold risk criterion. If the re-identification risk score does not meet the threshold risk criterion, the method may comprise anonymizing the genomic data set by selecting a phenotype informative SNP and masking the selected phenotype informative SNP. If the re-identification risk score meets the threshold risk criterion, the method may comprise outputting the anonymized genomic data set.

Embodiments help to improve the privacy and security associated with genomic data whilst also improving the amount of information available, for example to researchers. Various examples and embodiments are provided herein describing how the re-identification risk score is determined and how the genomic data set is anonymized. By using a threshold risk criterion, the level of acceptable risk may be taken into account and a genomic data set may be accordingly anonymized. Moreover, the amount of information retained in the genomic data set may be maximized by avoiding removing clinically relevant unnecessarily.

Aspects of the presently disclosed subject matter include a corresponding system for anonymizing a genomic data set.

Executable code for an embodiment of the method may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product comprises non-transitory program code stored on a computer readable medium for performing an embodiment of the method when said program product is executed on a computer.

In an embodiment, the computer program comprises computer program code adapted to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium.

Another aspect of the presently disclosed subject matter provides a method of making the computer program available for downloading. This aspect is used when the computer program is uploaded into, e.g., Apple’s App Store, Google’s Play Store, or Microsoft’s Windows Store, and when the computer program is available for downloading from such a store.

BRIEF DESCRIPTION OF THE DRAWINGS

Further details, aspects, and embodiments will be described, by way of example, with reference to the drawings. Elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. In the Figures, elements which correspond to elements already described may have the same reference numerals. In the drawings,

Figure 1 schematically shows an example of an embodiment of a system for anonymizing a genomic data set,

Figure 2 schematically shows an example of a genomic data set,

Figure 3 schematically shows an example of an embodiment of a method for calculating a re-identification risk score, Figure 4 schematically shows an example of an embodiment of a method for anonymizing a genomic data set,

Figure 5 schematically shows an example of a computer readable medium having a writable part comprising a computer program according to an embodiment, and

Figure 6 schematically shows a representation of a processor system according to an embodiment.

List of Reference Numerals:

100 a system

110 a processor subsystem

120 an external network

130 an input/output subsystem

140 a memory

142 a genomic data set

144 instructions

150 a data interface

200 a genomic data set

330 a database

1000 a computer readable medium

1010 a writable part

1020 a computer program

1110 integrated circuit(s)

1120 a processing unit

1122 a memory

1124 a dedicated integrated circuit

1126 a communication element

1130 an interconnect

1140 a processor system

1100 a device

DETAILED DESCRIPTION OF EMBODIMENTS

While the presently disclosed subject matter is susceptible of embodiment in many different forms, there are shown in the drawings and will herein be described in detail one or more specific embodiments, with the understanding that the present disclosure is to be considered as exemplary of the principles of the presently disclosed subject matter and not intended to limit it to the specific embodiments shown and described.

In the following, for the sake of understanding, elements of embodiments are described in operation. However, it will be apparent that the respective elements are arranged to perform the functions being described as performed by them.

Further, the presently disclosed subject matter is not limited to the embodiments, as features described herein or recited in mutually different dependent claims may be combined.

Figure 1 schematically shows an example of an embodiment of a system 100 for anonymizing a genomic data set. System 100 may comprise a processor subsystem 110 and an input/output subsystem 130. In some embodiments, system 100 may further comprise a memory 140, which may be accessed via a data interface 150. Memory 140 may be a local memory, or may be a remote memory. In some embodiments, system 100 may be communicatively coupled to an external network or external entity 120.

In an embodiment, input/output (IO) subsystem 130 may comprise an interface for receiving input and/or outputting an output. For example, the IO subsystem 130 may be configured to receive a genomic data set corresponding to a genome of a person.

The genomic data set may comprise a plurality of alleles arranged in a plurality of single nucleotide polymorphisms (SNPs). A SNP indicates a position in the genome at which gene variations typically occur, and each allele is a variant form of a given gene, genetic sequence or SNP. That is, a SNP indicates a single genomic position at which at least a proportion of the population have different nucleotides at that position. SNP data may therefore be considered mutation data, and said mutation data can be used to identify the person from the genomic data set. Most commonly, a SNP corresponds to a pair of alleles, which may be nucleobases (adenine (A), cytosine (C), thymine (T) or guanine (G)). In autosomes, for example, one allele is inherited from the mother and one allele is inherited from the father. For each SNP, it is typically known what the wild type allele is and what the mutant allele is. A wild type allele is the allele which typically produces the phenotype most frequently found in a population, whereas the mutant allele is an allele which produces a phenotype other than the wild type phenotype. The alleles occupying the SNPs may be referred to as the genotype. The alleles making up each SNP may have an associated genotypic frequency, which may indicate how frequently said alleles occur in a population (e.g. the population of a region, a country, a continent, the world, a dataset, etc.) at the position of said SNP, and an associated phenotypic probability, which indicates the probability of said alleles producing a particular phenotypic trait. Many SNPs may contribute, or correspond to, one or more phenotypic traits. Such SNPs may be referred to as phenotype informative SNPs. Examples of phenotypic traits include exterior phenotypic traits, such as eye color, skin color, hair color or the like, and/or interior phenotypic traits, such as blood type, predisposition to diseases, lactose intolerance and the like. Such phenotypic traits may be considered to be indirect identifiers, as although such a trait may not on its own identify an individual, combinations of many such traits reduce the number of potential people to which the genome corresponding to the genomic data set may belong, and may ultimately identify a particular individual. In some embodiments, the genomic data set may comprise demographic data, such as age information, address information or the like. A simulated example snippet of a genomic data set is provided in Figure 2 and will be elucidated further in the corresponding description thereof.

In an embodiment, the IO subsystem 130 may be configured to receive an indication of a disease to be studied. A user, for example a researcher, may be interested in studying or researching a particular disease. Said disease may be known to correspond to a selection of SNPs. For example, a user may be interested in researching prostate cancer. The IO subsystem 130 may receive a user input indicating an interest in prostate cancer, and may provide, to the user or to another subsystem or process of the system 100, a list of SNPs that are known to relate or contribute to prostate cancer. In some embodiments, a user may select or indicate a particular disease via the IO subsystem 130, and the known related SNPs may be retrieved, for example from an external source or from an internal memory such as memory 140. In some embodiments, the disease of interest may be predetermined or indicated in, or obtained from, the genomic data set. In some cases, SNPs that are known to contribute to a particular disease may also contribute to phenotypic traits, such as eye color or blood type.

The IO subsystem 130 may be further configured to store the received genomic data set in memory 140. The IO subsystem 130 may, in some embodiments, be configured to receive user input, such as an indication of a particular disease to be studied, or a selection of data within the genomic data set to be prioritized. The IO subsystem 130 may, in some embodiments, be configured to receive a target re-identification risk score to indicate a desired level of anonymization. For example, the target re-identification risk score may be used as a threshold risk criterion.

In some embodiments, the IO subsystem 130 may be configured to access an external network 120. External network 120 may comprise a cloud-based network, a server, an external database, an external device or the like. In some embodiments, the genomic data set(s), the threshold risk criterion and/or information on at least one disease may be stored in the external network 120 and accessed via the IO subsystem 130.

The IO subsystem 130 may, in some embodiments, comprise an input device configured to receive an input from a user, such as a touchscreen, a keyboard, a mouse, a trackpad or the like, or a sensor input, such as a camera, microphone, proximity sensor or the like. The IO subsystem 130 may, in some embodiments, comprise an output device such as a display, a speaker or the like, to provide an output to a user. In some embodiments, the IO subsystem 130 may be configured to process inputs and/or outputs from/to additional components, subsystems, or external entities. For example, the IO subsystem 130 may be configured to receive an input from an external device, a network such as a cloud-based network, a server, or a component of the system 100.

In an embodiment, memory 140 may be configured to store one or more genomic data sets, for example in a database for storing genomic data sets of a plurality of people. Additionally or alternatively, memory 140 may be configured to store instructions or information for use in the method for anonymizing a genomic data set. Memory 140 may also store a threshold risk criterion. The threshold risk criterion may be a criterion used to ensure that the anonymized genomic data set is sufficiently anonymized prior to being output or distributed, for example by ensuring that the re-identification risk score of the genomic data set complies with a specified risk level. The calculation of a reidentification risk score will be described in detail with reference to Figure 3. The threshold risk criterion may be, for example, a percentage, indicating a risk of reidentifying the person from the genomic data set, or an applicable population size, indicating the number of people having said phenotypic traits. A large number of people sharing the phenotypic traits corresponds to a low risk of re-identification. In some cases, such as when the starting population is small, use of a threshold applicable population size as the re-identification risk criterion may be particularly suitable.

Memory 140 may comprise at least one database, such as genomic database 142 and/or SNP database 144. Genomic database 142 may be configured to store one or more genomic data sets corresponding to a respective one or more people. SNP database 144 may be configured to store SNP information relating to one or more diseases, such as lists of SNPs corresponding to a particular disease. The memory 140 may be implemented as an electronic memory, for example a flash memory, or magnetic memory, say hard disk or the like, or optical memory, e.g., a DVD. The memory 140 may comprise multiple discrete memories together making up the memory 140. The memory 140 may comprise a temporary memory, e.g. a RAM. In the case of a temporary memory 140, memory 140 may be associated with a retrieving device to obtain data before use and to store the data in the storage, say by obtaining them over an optional network connection (not shown).

In an embodiment, the memory 140 may comprise a local memory and/or an external (e.g. remote) memory. For example, the genomic database 142 may be stored in a local memory. The SNP database 144 may be stored externally and, in some cases, may be merely accessed by the system 100. In another example, the genomic database 142 may be stored externally, such as in a central (e.g. government) database. The genomic database 142 and the SNP database 144 may be stored in the same storage location, or in different storage locations.

The processor subsystem 110 may comprise at least one processor, and may be referred to as at least one processor circuit. In an embodiment, processor subsystem 110 may be configured to determine a re-identification risk score of a genomic data set and to anonymize the genomic data set. In some embodiments, the processor subsystem 110 may be configured to preprocess the genomic data set, for example by masking, e.g. deleting, any direct identifiers therein. A direct identifier may be a SNP whose data independently identifies an individual without the need for additional information, such as data relating to other SNPs. In some embodiments, the processor subsystem 110 may preprocess the genomic data set by obtaining a list of SNPs of interest to the user, for example by obtaining a list of SNPs that relate to or contribute to a particular specified disease from the user directly or from a database in memory 140 or via an external network 120. In some embodiments, the processor subsystem 110 may be configured to mask, e.g. delete, SNPs of the genomic data set that do not relate to the specified disease, for example by masking, e.g. deleting, SNPs that are not included in the obtained list of relevant SNPs. In some embodiments, knowledge of the SNPs contributing or relating to a particular disease is incomplete, and a researcher may prefer not to limit the genomic data set based on an incomplete list of SNPs. The processor subsystem 110 may be configured to calculate a reidentification risk score from the genomic data set. The calculation of the re-identification risk score may be based on one or more phenotypic traits. For each specified phenotypic trait, the genotypic frequency of one or more phenotype informative SNPs relating to said phenotypic trait, the phenotypic probability of said phenotype informative SNPs producing said phenotypic trait, and a proportion of a population which has said phenotypic trait may be used in the calculation of the re-identification risk score. These terms will be more fully described with reference to Figure 2, and the calculation of the re-identification risk score will be described in detail with reference to Figure 3.

The processor subsystem 110 may be configured to compare the calculated re-identification risk score to a threshold risk criterion. The threshold risk criterion, which may also be referred to as a threshold re-identification risk criterion, may be stored locally, such as in memory 140, received from a user as user input via IO subsystem 130, or obtained from an external network 120 via IO subsystem 130, for example. If the calculated re-identification risk score meets the threshold risk criterion, then the genomic data set is sufficiently anonymized and may be output, for example to an external device or to a user, or stored in, e.g. local, memory. If the calculated re-identification risk score does not meet the threshold risk criterion, then the genomic data set is not yet sufficiently anonymized, and the processor subsystem 110 may be configured to anonymize the genomic data set by masking, e.g. deleting, data corresponding to one or more SNPs.

The system 100 may further comprise a data interface 150. The data interface 150 may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, an optical connector, etc., or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G or 5G antenna. The data interface 150 may provide access to a memory 140.

The various subsystems of the system 100 may be disposed within a single device, or may communicate with each other over a computer network. The computer network may be an internet, an intranet, a LAN, a WLAN, etc. The computer network may be the Internet. The computer network may be wholly or partly wired, and/or wholly or partly wireless. For example, the computer network may comprise Ethernet connections. For example, the computer network may comprise wireless connections, such as Wi-Fi, ZigBee, and the like. The subsystems may comprise a connection interface which is arranged to communicate with other subsystems of system 100 as needed. For example, the connection interface may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, an optical connector, etc., or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G or 5G antenna. The computer network may comprise additional elements, e.g., a router, a hub, etc.

Figure 2 schematically shows an example of a genomic data set 200. The genomic data set 200 may comprise a plurality of parameters for each SNP, such as those depicted in Figure 2 - SNP 210, which indicates a position or other identifier of a SNP, Genotype 220, which indicates the alleles at said SNP, Allele frequency 1 230, which indicates the frequency of the first allele in the plurality of alleles occupying said SNP, Allele frequency 2 240, which indicates the frequency of the second allele in the plurality of alleles occupying said SNP, Genotype frequency 250, which indicates the frequency of the genotype, e.g. the alleles of the SNP, occurring in a population such as a regional or global population, or in some cases a population of a dataset, Phenotype 260 (also referred to as phenotype probability 260), which indicates the probability of a particular phenotypic trait being produced by the genotype of said SNP and Disease Correlation 270, which indicates whether a SNP has a known correlation to a particular disease of interest. It is to be understood that a genomic data set may not comprise all of the listed parameters and the genomic data set may comprise parameters other than those listed, and the listed parameters are merely illustrative. For example, a genomic data set may comprise merely SNP 210 and Genotype 220, and any further information such as genotype frequency, phenotype probability and/or disease correlation may be obtained by querying a database or accessing a data source, e.g. via the external network 120. For example, based on an entry for SNP 210-a (SNP_E1) and the associated genotype (“AA” in the table of Figure 2), the system 100 may be configured to look up an associated genotype frequency, which, in this example, is the frequency of genotype AA occupying SNP El, in a population (64% in this simulated example), a phenotype probability - in this example, the probability that the genotype AA at SNP_E1 will produce blue eyes is 40%, and whether or not SNP El is known to have any relevance to prostate cancer (prostate cancer is denoted as PCa in the table of Figure 2). For example, genotype frequency, phenotype probability and any relevant parameters may be obtained or accessed from the same data source, such as a single database, or from various data sources.

The sample of simulated genomic data set 200 shown in Figure 2 includes data corresponding to a plurality of phenotype informative SNPs. The genomic data set 200 corresponds to the simulated genome of a person having blue eyes, brown hair and light skin. In this example, it is assumed for the sake of simplicity that these three phenotypes form a set of indirect identifiers based on which a re-identification risk score is calculated. However, the use of these phenotypic traits is merely illustrative, and are non-limiting. More or fewer phenotypic traits may be used. This example, in which these three phenotypic traits are considered, will be followed throughout the present disclosure, to illustrate the methods and devices described herein.

In this example, the first phenotypic trait is “blue eyes”. SNPs which contribute to or affect eye color may be SNP El, SNP_E2, SNP_E3, SNP_E4 and SNP E5. According to the genomic data set of a particular individual, SNP El is populated by genotype AA (e.g., the genotype comprises two alleles, each of which are adenine nucleotides). The frequency of genotype AA at the position in the genome corresponding to SNP El in a population is 64% (according to this simulated example). The probability of this genotype AA at this position resulting in blue eyes is 40%, and SNP El is known to contribute or relate to prostate cancer.

Similarly:

• SNP_E2 is populated by genotype AG, which has a genotype frequency of 4.5% and is 80% likely to result in blue eyes, and has no known correlation or contribution to prostate cancer;

• SNP_E3 is populated by genotype GT, with genotype frequency of 20%, with a 95% probability of producing blue eyes, and has a known correlation to prostate cancer;

• SNP_E4 is populated by genotype CC, with a genotype frequency of 81% and a 50% probability of producing blue eyes, with no known correlation to prostate cancer; and

• SNP_E5 is populated by genotype CT, with a genotype frequency of 17.5% and a 70% probability of producing blue eyes, with no known correlation to prostate cancer.

Continuing with this example, SNP H1, SNP H2 and SNP H3 are SNPs relating to hair color, and SNP_S1, SNP_S2, SNP_S3 and SNP_S4 are SNPs relating to skin color. Of particular note is that SNP El and SNP H1, each denoted by 210-a, are the same SNP - that is, they correspond to the same position in the genome and are populated by the same alleles. This particular SNP contributes to both eye color and skin color, and the genotype AA populating said SNP has a 40% probability of producing blue eyes and a 55% probability of producing light skin.

The re-identification risk score may be calculated based on parameters such as those shown in the table of Figure 2. This calculation will be described in further detail with reference to Figure 3.

Once calculated, the re-identification risk score may be compared to a threshold risk criterion, which may be an applicable population or a percentage, for example. The applicable population may correspond to a proportion of the population of a region (e.g. country, world etc.) or the population of the dataset, or the like. Further details regarding the threshold risk criterion will be further described with reference to Figure 4. If the re-identification risk score does not meet the threshold risk criterion, then data corresponding to one or more phenotype informative SNPs may be masked and the re-identification risk score may be re-calculated, without the data of the one or more masked phenotype informative SNPs. Masking an SNP may comprise deleting the data corresponding to the SNP, replacing the data corresponding to the SNP with null data, or any known masking method, for example. The process of masking one or more SNPs and recalculating the re-identification risk score may be repeated until the re-identification risk score meets the threshold risk criterion.

Figure 3 schematically shows an example of an embodiment of a method for calculating a re-identification risk score. A first phenotypic trait, PT_current 310 may be selected. The first, or current, phenotypic trait PT_current 310 may be selected from a list of phenotypic traits to be considered in the calculation of the re-identification risk score, or from a list of all known phenotypic traits. In some embodiments, the list of phenotypic traits from which first phenotypic trait PT_current 310 may be selected may comprise exterior phenotypic traits, such as eye color, hair color and the like, interior phenotypic traits, such as blood type and the like, or a combination of both exterior phenotypic traits and interior phenotypic traits. In some embodiments, the list of phenotypic traits to be considered in the calculation of the re-identification risk score may be received as an input from a user or from another subsystem or device. In some embodiments, the list of phenotypic traits to be considered may be obtained from a database or may be determined based on the phenotypic traits exhibited by the individual whose genomic data set is to be anonymized. For example, if the person has blue eyes, brown hair and light skin, these phenotypic traits may be included in the list of phenotypic traits to be considered in the calculation of re-identification risk score.

The first phenotypic trait PT_current 310 may be correlated to one or more phenotype informative SNPs present in the genomic data set. That is, one or more positions on the genome may be known to contain mutations which result, or contribute to, the expression of the first phenotypic trait. For the sake of illustration, these SNPs are shown as SNP_1 320-1, SNP_2 320-2 and SNP-n 320-n, although it is to be understood that there may be more or fewer SNPs for a particular phenotypic trait, and that the same SNP may contribute to multiple phenotypic traits, to the same or different extents.

For at least one of the identified SNPs, taking SNP_1 320-1 as an example, a genotypic frequency Gfreq_l 340a-l and a phenotypic probability Pprob_l 340b-l may be obtained, for example from a database DB 330. Database DB 330 may be stored in a local memory such as memory 140 or in an external memory, such as in cloud storage or in an external device. For example, Database DB 330 may be accessed via an external network such as external network 120. In some embodiments, database DB 330 may be a central database to be accessed by researchers from an organization, collaboration or the like. In some embodiments, the genomic data set may comprise one or more of the genotypic frequency Gfreq_l 340a-l and the phenotypic probability Pprob_l 340b-l, so that these values may be obtained without using a separate database. The genotypic frequency Gfreq_l 340a-l may indicate a frequency of SNP_1 320-1 being occupied by the alleles indicated in the genomic data set at SNP_1 320-1. The phenotypic probability Pprob_l 340b-l may indicate that a probability of those alleles producing, or resulting in, the first phenotypic trait. In some embodiments, the genotypic frequency and phenotypic probability may be combined to obtain a risk term for each SNP, for use in the calculation of a re-identification risk score. The risk term may be an intermediate value. For example, risk term PT_r_l 350-1 may be determined for SNP_1 320-1 by combining Gfreq_l 340a-l and Pprob_l 340b-l. The risk term PT_r_l 350-1 may be, or may comprise, the product of the genotypic frequency Gfreq_l 340a-l and the phenotypic probability Pprob_l 340b-l, or a sum of logarithmic values of Gfreq_l 340a- 1 and Pprob_l 340b-l, or the like.

In some embodiments, these values may be obtained for each phenotype informative SNP - for example, genotypic frequency Gfreq_2 340a-2 and phenotypic probability Pprob_2 340b-2 of SNP_2 320-2, and genotypic frequency Gfreq_n 340a-n and phenotypic probability Pprob_n 340b-n of SNP_n 320-n. A risk term associated with each SNP may be calculated therefrom, for example to obtain a risk term PT_r_2 350-2 corresponding to SNP_2 320-2 and a risk term PT_r_n 350-n corresponding to SNP_n 320-n and so on.

In some embodiments, the largest risk term PT_r_max 360 may be determined, depicted by MAX 355. MAX 355 may return the largest risk term PT_r_max 360 of the risk terms PT_r_l 350-1 to PT_r_n 350-n corresponding to the SNPs SNP_1 320-1 to SNP_n 320-n. In some embodiments, MAX 355 may also return the SNP corresponding to the largest risk term PT_r_max 360. If, for example, the first phenotypic trait has three related SNPs - SNP_1 320-1, SNP_2 320-2 and SNP-n, 320-n - then PT_r_max 360 would be the largest of PT_r_l 350-1, PT_r_2 350-2 and PT_r_n 350-n. Although the above refers to the use of a maximum, it is to be understood that the present method is not limited thereto. For example, in some embodiments, the average risk term (e.g. the average risk term across SNPs 320 relating to a particular phenotypic trait) may be determined instead of the largest risk term. For example, the choice between using an average risk term and a maximum term may be based at least in part on the type of risk or attacker that the de-identification efforts are addressing.

In some embodiments, a proportion of the population PT_pop 340c which exhibits the first phenotypic trait may be obtained, for example from a database such as DB 330. The proportion of the population exhibiting the first phenotypic trait PT_pop 340c may be combined with the largest risk term PT_r_max 360, to obtain a contribution term corresponding to the first phenotypic trait, PT_cont 370. For example, the contribution term PT_cont 370 may be a quotient of PT pop 340c and PT_r_max 360, or a difference between logarithmic terms of PT pop 340c and PT_r_max 360. Once the contribution term PT_cont 370 has been determined, the method may comprise selecting a next phenotypic trait PT_next 375 and repeating the process, by setting PT next 375 as PT_current 310, as indicated by the arrows in the flowchart of Figure 3.

The contribution term PT_cont 370 may also be combined with other contribution terms, for example contribution terms corresponding to other phenotypical traits, to obtain a total phenotypic trait term PT_tot 380. In the first iteration, e.g. for the first phenotypic trait, the total phenotypic trait term PT_tot 380 may be merely set to be the contribution term PT_cont 370 corresponding to the first phenotypic trait. In some embodiments, the total phenotypic trait term PT_tot 380 may be updated as the contribution term for each phenotypic trait is determined. For example, phenotypic trait contribution PT_cont 370 of the first phenotypic trait and contribution terms of other phenotypic traits may be multiplied, or added logarithmically, e.g. the logarithms of the contribution terms may be added. In some embodiments, contribution terms for each phenotypic trait of interest may be determined as described herein and combined once all of said contribution terms have been calculated, for example by finding the product of said contribution terms, or by finding the sum of the logarithms of said contribution terms.

In some embodiments, the total phenotypic trait term PT_tot 380 may be combined with a population size Pop 340d, which may be a regional or global population, or a proportion of a population that has been already determined, to obtain an applicable population AP 390. For example, if the user has an interest in researching prostate cancer in patients aged between 50 and 75, the population may be the number of people in the region of interest (e.g. in Europe, or in the United States, or globally, etc.) who are men between the ages of 50 and 75. The population size Pop 340d may be obtained from a database such as database DB 330, as an input from a user, from memory, or the like. For example, the applicable population AP 390 may be determined by multiplying the population size Pop 340d with the total phenotypic trait term PT_tot 380, or by equivalently summing the logarithms of the population size Pop 340d and the total phenotypic trait term PT_tot 380. The applicable population AP 390 may indicate the number of people whose genomes would be consistent with that of the genomic data set.

In some embodiments, the applicable population 390 may be used as the reidentification risk score RelD Risk 395, for example if the threshold risk criterion indicates a number of people. In some embodiments, the re-identification risk score RelD Risk 395 may be determined from the applicable population. For example, reidentification risk score RelD Risk 395 may be a risk that a particular individual may be identified from the genomic data set, and may be calculated as the inverse of the applicable population AP 390, e.g. 1/AP. This may be suitable if the threshold risk criterion is based on a risk level, for example determined or prescribed by ethical or privacy requirements.

An equation for calculating the re-identification risk score according to one embodiment is provided below:

(Equation 1) 1

RelD Risk = —

AP

(Equation 2) Where:

• i € II indicates a phenotypic trait of a set II of phenotypic traits

• s E SNPi indicates a SNP relating to phenotypic trait i

• Gfreq _{s i} indicates a genotypic frequency of the alleles populating the SNP s

• Pprob _{s i} indicates a phenotypic probability that the alleles populating the SNP s will result in phenotypic trait i.

• max indicates the SNP of the set of SNPs corresponding to seSNPi phenotypic trait i for which the product of Gfreq _{s i} and Pprob _{s i} is at a maximum

• Pop indicates a population size

• PT_Popi indicates a proportion of a population exhibiting phenotypic trait i

As indicated above, the calculation of the applicable population is not limited to the use of a maximum term ( max ). In some embodiments, for example, the maximum seSNPi term max may be replaced with an average term across the SNPs of the set of SNPs corresponding to the phenotypic trait i or the like.

Moreover, although the re-identification risk score is denoted here as simply being the inverse of the applicable population, it is to be understood that the calculation is not limited thereto. For example, additional dimensions may be used in the computation of the risk score in addition to the applicable population. Such dimensions may include, for example, one or more of: the power of the attacker (e.g. their ability to access various identification databases), the probability, or chance, of an attack (e.g. internal/extemal) based on existing context and thresholds and/or weights corresponding to the phenotypes and the population (e.g. the proportion of data subjects that have a re-identification risk higher than that threshold, dependencies between phenotypes that divide the applicable population and the like).

In some embodiments, an additional correction factor may be used to take into account dependencies between multiple phenotypic traits. The additional correction factor may be based at least in part on available statistics, such as those indicating an association between two traits or conditions. For example, consider the proportion of the population exhibiting a phenotypic trait of high BMI (body mass index) and heart disease. In general, obese people (obese being defined medically according to a BMI score exceeding a threshold) make up approximately 20% of the general population. However, obese people make up 40% of the population of people with heart disease. In this example, it is apparent that there is a relation between the phenotypes of high BMI and heart disease, and this relation can be used as the correction factor. For example, the correction factor may be to use a factor of 40% instead of a factor of 20% in calculating the proportion of the population used in the term PT_Pop.

Figure 4 schematically shows an example of an embodiment of a computer- implemented method for anonymizing a genomic data set.

The method may comprise, in an operation entitled “RECEIVE GENOMIC DATA SET”, receiving 410 a genomic data set, for example from a user or from a data source such as memory 150 or from an external source, e.g. via external network 120. In some embodiments, the genomic data set may be obtained after data corresponding to direct identifiers have been removed. That is, in some embodiments, the genomic data set may comprise data corresponding to indirect identifiers.

The method may comprise, in an operation entitled “OBTAIN PARAMETERS”, obtaining 420, for at least one phenotypic trait, a population proportion, e.g. PT_pop, indicating a proportion of a population exhibiting said phenotypic trait, and for at least one phenotypic SNP corresponding to said phenotypic trait, a genotypic frequency, e.g. Gfreq, and a phenotypic probability, e.g. Pprob, as described with reference to Figure 3. In some embodiments, obtaining 220 parameters may comprise obtaining a population size, such as Pop 340d. In some embodiments, obtaining 420 parameters may comprise obtaining a list of phenotypic traits and/or a list of SNPs relating to each of at least one phenotypic trait.

The method may comprise, in an operation entitled “COMPUTE REIDENTIFICATION RISK SCORE”, computing 430 a re-identification risk score for the genomic data set. Computing 430 the re-identification risk score may be performed, for example, as described with reference to Figure 3.

The method may comprise, in an operation entitled “COMPARE TO THRESHOLD”, comparing 440 the computed re-identification risk score to a threshold risk criterion. If the re-identification risk score meets the threshold risk criterion, the method may proceed to an operation entitled “OUTPUT ANONYMIZED DATA SET”, in which the genomic data set is output 470, for example to a user or to another subsystem, function or device. In some embodiments, outputting the anonymized data set may comprise storing the anonymized data set, for example in memory 140. In some embodiments, the genomic data set may be output to a database such as database DB 330, or the genomic data set may be output to an external device, e.g. via external network 120, such as to a central database or central storage device, in the cloud or in a remote device. In some embodiments, the genomic data set may be encrypted prior to outputting, e.g. storing or transmitting, the genomic data set. In some embodiments, the re-identification risk score may be output along with the anonymized data set. Outputting the reidentification risk score as well as the anonymized genomic data set may enable the anonymized data set to be used, e.g. in subsequent research or applications, which may have a different level of acceptable risk of re-identification (e.g. the threshold reidentification risk threshold may vary). By including the re-identification risk score of an anonymized genomic data set, if the re-identification risk score already meets the threshold re-identification risk threshold of the subsequent research or application, then re-anonymization may be avoided or at least reduced.

In some embodiments, the re-identification risk score may be computed as a percentage, for example by taking the inverse of the applicable population as shown in Equation 2. In such embodiments, the threshold risk criterion may take the form of a percentage indicating a risk of re-identifying an individual from the genomic data set. That is, the threshold risk criterion may indicate the probability that an individual may be identified from the genomic data set. For example, a threshold risk criterion of 0.05% would indicate an acceptable anonymization is achieved if the genomic data set provides a 0.05% risk of the person being re-identified. The threshold risk criterion may therefore be met if the calculated re-identification risk score is below the threshold risk criterion, and may not be met if the computed re-identification risk score is greater than the threshold re-identification.

In some embodiments, the re-identification risk score may be calculated as an applicable population, for example as indicated by Equation 1. In such embodiments, the threshold risk criterion may take the form of a raw number, such as a raw population size. That is, the threshold risk criterion may indicate a number of people within a population which the genomic data set could identify. The threshold re-identification risk score may therefore be met if the computed re-identification risk score (e.g. calculated applicable population) exceeds the threshold risk criterion.

If comparing 440 the re-identification risk score to the threshold risk criterion indicates that the re-identification risk score does not meet the threshold risk criterion, a phenotype informative SNP present in the genomic data may be selected 450 and masked 460. Masking the selected phenotype informative SNP may comprise deleting the data corresponding to the selected phenotype informative SNP in the genomic data set, replacing the data corresponding to the selected phenotype informative SNP with dummy data or null data, or otherwise obscuring the data corresponding to the selected phenotype informative SNP.

A phenotype informative SNP may be selected by identifying the phenotype informative SNP whose contribution term is the smallest when computing the applicable population. In other words, the phenotype informative SNP whose contribution is the highest when computing the re-identification risk score is identified, since the inverse of the applicable population may be used to calculate the re-identification risk score. The contribution term may be determined as described with reference to Figure 3, the contribution term corresponding to phenotypic trait contribution term PT_cont 370. In some embodiments, the contribution term for each phenotypic trait is stored, e.g. temporarily, with information identifying which phenotype informative SNP corresponds to said contribution term, the phenotype informative SNP whose corresponding risk term is the largest risk term PT_r_max 360 that contributes to the smallest contribution term PT_cont 370 may be selected in operation 450.

In some embodiments, one or more phenotype informative SNPs may have an associated priority indication. Data corresponding to phenotype informative SNPs with an associated priority indication may, in some embodiments, be preserved in the genomic data set such that they are not selected and masked in operations 450 and 460, respectively. For example, selecting 450 a phenotype informative SNP may comprise determining the smallest contribution term which is associated with a phenotype informative SNP (e.g. determining the contribution of the phenotype informative SNP which contributes the most to the re-identification risk score) without a priority indication. To illustrate this, consider the following example in which, for a particular phenotypic trait, the risk term PT_r_l 350-1 of SNP_1 320-1 in Figure 3 is the largest risk term for said phenotypic trait (e.g. PT_r_l 350-1 = PT_r_max 355), and the resulting contribution term PT_cont 370 is the smallest contribution term contributing to the re-identification risk score, which does not meet the threshold risk criterion. If SNP_1 320-1 has an associated priority indication, despite corresponding to the smallest contribution term, the data corresponding to SNP_1 320-1 may not be selected or masked. Instead, the next smallest contribution term and its associated phenotype informative SNP may be determined. If the phenotype informative SNP associated with the next smallest contribution does not have a priority indication, then said phenotype informative SNP may be selected in operation 450 and its corresponding data may be masked in operation 460.

Priority indications may be obtained by user input. In some embodiments, a user may have a particular interest in a subset of the phenotype informative SNPs and may wish to ensure that said subset is present in the anonymized data set. The user may, in such cases, input a list of SNPs of interest, either separately or as an additional field or flag in the genomic data set to be anonymized. In some embodiments, priority indications may be assigned automatically, based on a proximity to SNPs known to relate to a particular disease of interest. The proximity of an SNP to another SNP may be determined in any known method, for example using the genome pathways network described in patent application EP 3479272 Al and incorporated herein by reference in its entirety, and in particular as described in page 4 line 28 to page 5 line 3, and page 6 line 18 to page 7 line 9. For example, SNPs within a predefined distance or proximity to an SNP of interest or to a SNP known to contribute to a particular disease may be prioritized by assigning a priority indication to such SNPs.

For example, a user may indicate a particular SNP of interest. The distance between each of the phenotype informative SNPs of the genomic data set and the indicated SNP may be determined, for example using the genomic pathways network. If, for a SNP, the distance between said SNP and the indicated SNP is below a threshold distance, then the SNP may be added to a subset of phenotype informative SNPs to which a priority indication may be applied.

Once a phenotype informative SNP has been masked in operation 460, the reidentification risk score may be calculated anew in operation 430, without the use of data corresponding to the masked phenotype informative SNP. That is, the phenotype informative SNP selected in operation 450 is effectively removed from the genomic data set. Subsequent calculations of the re-identification risk score may not include the use of data corresponding to such phenotype informative SNPs.

Phenotype informative SNPs may be removed from the genomic data set, e.g. by masking said phenotype informative SNPs, until the resulting re-identification risk score meets the threshold risk criterion. For example, if the threshold risk criterion denotes an acceptable risk level, the selecting and masking of phenotype informative SNPs and the recalculating of the re-identification risk score may repeat until the genomic data set is sufficiently anonymized.

Figure 5 schematically shows an example of a computer readable medium having a writable part comprising a computer program the computer program 1020 comprising instructions for causing a processor system to perform a method, such as the method of Figure 4. The computer program 1020 may be embodied on the computer readable medium 1000 as physical marks or by magnetization of the computer readable medium 1000. However, any other suitable embodiment is conceivable as well. Furthermore, it will be appreciated that, although the computer readable medium 1000 is shown here as an optical disc, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable. The computer program 1020 comprises instructions for causing a processor system to perform said method of providing diagnosis support to a user.

Figure 6 schematically shows a representation of a processor system 1140 according to an embodiment of the system 100 for anonymizing a genomic data set. The processor system comprises one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is schematically shown in Figure 6. Circuit 1110 comprises a processing unit 1120, e.g., a CPU, for running computer program components to execute a method according to an embodiment and/or implement its modules or units. Circuit 1110 comprises a memory 1122 for storing programming code, data, etc. Part of memory 1122 may be read-only. Circuit 1110 may comprise a communication element 1126, e.g., an antenna, connectors or both, and the like. Circuit 1110 may comprise a dedicated integrated circuit 1124 for performing part or all of the processing defined in the method. Processor 1120, memory 1122, dedicated IC 1124 and communication element 1126 may be connected to each other via an interconnect 1130, which may be a bus. The processor system 1110 may be arranged for contact and/or contact-less communication, using an antenna and/or connectors, respectively.

For example, in an embodiment, processor system 1140, e.g., the system for anonymizing a genomic data set may comprise a processor circuit and a memory circuit, the processor being arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, ARM Cortex-R8, etc. In an embodiment, the processor circuit may be ARM Cortex MO. The memory circuit may be an ROM circuit, or a non-volatile memory, e.g., a flash memory. The memory circuit may be a volatile memory, e.g., an SRAM memory. In the latter case, the system may comprise a non-volatile software interface, e.g., a hard drive, a network interface, etc., arranged for providing the software.

While the system 100 for anonymizing a genomic data set is shown as including one of each described component, the various components may be duplicated in various embodiments. For example, the processor 1120 may include multiple microprocessors that are configured to independently execute the methods described herein or are configured to perform steps or subroutines of the methods described herein such that the multiple processors cooperate to achieve the functionality described herein. Further, where the system 100 is implemented in a cloud computing system, the various hardware components may belong to separate physical systems. For example, the processor 1120 may include a first processor in a first server and a second processor in a second server.

It should be noted that the above-mentioned embodiments illustrate rather than limit the presently disclosed subject matter, and that those skilled in the art will be able to design many alternative embodiments.

In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb ‘comprise’ and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. The article ‘a’ or ‘an’ preceding an element does not exclude the presence of a plurality of such elements. Expressions such as “at least one of’ when preceding a list of elements represent a selection of all or of any subset of elements from the list. For example, the expression, “at least one of A, B, and C” should be understood as including only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The presently disclosed subject matter may be implemented by hardware comprising several distinct elements, and by a suitably programmed computer. In the device claim enumerating several parts, several of these parts may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. In the claims references in parentheses refer to reference signs in drawings of exemplifying embodiments or to formulas of embodiments, thus increasing the intelligibility of the claim. These references shall not be construed as limiting the claim.