Privacy-preserving linkage of multi-modal pseudonymised rare disease data

In rare diseases, it is paramount to fully exploit all available data, which are distributed over several multimodal resources, including biomaterials, images, clinical trials, registries, and many others. Many of these resources are pseudonymised and (as required by the General Data Protection Regulation GDPR [1]), different pseudonyms are used in different resources. This makes it hard to link such records without registering specific patients twice. With Privacy-Preserving Record Linkage (PPRL), personalised or pseudonymised datasets can be joined, without disclosing the patients’ identities. PPRL is a key technology for rare disease research [2].

There is a huge number of use cases for PPRL in rare diseases, which derive from six key dimensions to specify use cases: 1) Different types of distributed personalised records; 2) Pseudonymisation; 3) Different types of distributed pseudonymised records; 4) Linkage of the (personalised and/or pseudonymised) records; 5) Temporary or persistent linked data repositories; 6) Different kinds of data analysis, from simple counting to artificial intelligence. PPRL can be used for primary use (e.g., pseudonymised virtual tumour boards with multi-centric experts) and secondary use scenarios (e.g., retrospective linkage of biobanking data with multiple clinical trial databases).

The EUPID Services [3] represent a PPRL Service, which is well-proven, GDPR-compliant, approved by an external security audit. They have been used widely for rare disease research in primary and secondary use scenarios (see e.g., [4-7]). By state-of-the-art encryption and hashing algorithms, the EUPID Services support privacy-preserving linkage of distributed records. Optionally, they also support a specific, structured protocol for re-identification of patients in emergency situations by one or more trusted third parties. The EUPID Services have been applied on prospectively collected data, and on retrospective datasets.

In conclusion, PPRL Services represent a valuable technology for GDPR-compliant, multi-centric and/or multi-modal project data management, long-term registries and various other rare disease scenarios.