1

So my thesis proposal is about predicting mortality rates. I will work with a company (insuretech) that already has database of 2m+ people with death dates (if dead), birth date, transaction volume (money), and which collective insurance this person have (out of 4 possible).

Now, I'm will use machine learning to predict mortality rate of, for example, a group of people that are X years old, male and has insurance A. So the overall published results are very aggregated (For example: 40% of all 90 year old males will die this year, according to my predictions).

I will never ever publish the data of ANY individual, all the machine learning and data processing will be done in house of the company, locally on their computers. I also only have clearance to anonymised data (pseudo addresses and names).

This will be my research paper at my university, done together with a company for academic purposes as well as for the interests of the company.

So to sum this up:

  1. Personal data will be used, it was already legally obtained as it's necessary information for my host company (insuretech).
  2. The results are not targeted to any of the individuals from the database, but only aggregated statistical results are published regarding groups of people.
  3. No data that can identify anyone is published whatsoever. Again, only aggregated results from personal data will be presented.
  4. I will take precautions to process the data in a safe environment
  5. This will be a published paper

Is this ok within the scope of GDPR?

Improve this question

2 Answers 2

Reset to default
1

Let me start by saying based on your posted information it is a breach of GDPR.

Well, do not take this wrong, yet to answer your question I have to play the "devil's advocate" role.

1st, machine learning = automated processing (meaning the Data Subject must be informed and be entitled to opt-out) then "... predicting mortality rates (...) of, for example, a group of people that are X years old, male and has insurance A (...) data processing will be done in-house of the company, locally on their computers..." then "... I will never ever publish the data of ANY individual..." then "... my research paper at my university, y, done together with a company for academic purposes..." + conclusions which are assumptions "... Personal data will (...) was already legally obtained..." - WHY is it legal?! "... No data that can identify anyone is published whatsoever (...) only aggregated results..."

So many wrong things in this entire text (or at least in need of clarification), namely: The Lawful Base is not transferable when you are not part of the "Process", meaning even if the insurance company has a LAwful Base to Process the Data in detail (being able to identify the natural persons, you are not a Processor under that scope, so once you come into the equation, the Lawful Base needs to be validated and most likely changed to Consent.

Then your thesis is not Scientific Investigation, unless the community will end up benefiting from it... a medical trial means potential benefit for the community; your thesis directly means benefit for you... so unless you raise a clear benefit for the community you are unlikely to be able to argue Scientific Investigation purposes as your exemption base.

The fact that a company is involved in the process (if other than the one which already has the Data and under a Lawful Basis) renders the entire topic even more delicate...

Last, but not least, given the way those natural persons are "clustered" in the publishing materials in terms of geography and ciclographics... that may still enable their individual identification... meaning, let's imagine statistics demonstrate that in Scotland any male with 95 years of age or more has a 90% probability of dying within the next 12 months and there are towns where only a couple of individuals in these circumstances live... Remember, Personal DAta is any Data that either on its won OR WHEN CROSS-REFERENCED with OTHER DATA enables the identification of a natural person.

Sorry, this is my interpretation of the entire matter as you have posted it.

Improve this answer
4
  • Okay, so first the age limit I'll working with is 75, and no geographical area at all. Secondly:
    – Shhua
    Jun 20, 2019 at 10:22
  • Secondly: "Processing shall be lawful only if and to the extent that at least one of the following applies: " in which the last one is "(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except....". And it's in the legitimate interests of a insurance company if I were doing mortality prediction. Also yes, the company already has the data under a lawful basis.
    – Shhua
    Jun 20, 2019 at 10:34
  • Thank you for answering, is there anything else you want me to clarify?
    – Shhua
    Jun 20, 2019 at 10:34
  • The GDPR has provisions on: automated individual decision-making (making a decision solely by automated means without any human involvement); and profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process. I'm not profiling or doing automated descision making. It's simple logistic regression that one can also do on Excel, but I'm just doing it the Machine Learning Way
    – Shhua
    Jun 20, 2019 at 10:38
0

The GDPR defines personal data as any information related to a natural person (data subject) that can be used to directly or indirectly identify that person.

So I would think you are ok it that respect, question is "insuretech" allowed to pass the information on to you in the first place, it would depend on how they stated how the data would be used when they collected the information.

Improve this answer
4
  • So I've done a bit of digging on insuretech company. They have a GDPR page that states the typical "we may use your personal data to develop our product further etc". My thesis will also be an internship in the company, and since I'm predicting mortality, it's directly relevant to the "development" of the product because you set prices based on mortality predictions. And I've obtained an explicit "yes you can use this data from the host company, just without regards to GDPR".
    – Shhua
    Jun 18, 2019 at 17:14
  • " And I've obtained an explicit "yes you can use this data from the host company, just without regards to GDPR" who gave you that? Insuretech? They are the ones that collected he data so there are the ones held responsible for the GDPR. Since they are a big company and hold sensitive personal information they should have a Data Protection Officer (DPO), so it would be best to check with them.
    – PaddyD
    Jun 19, 2019 at 8:14
  • Make no mistake ... this is very likely to be Personal Data... such classification derives also from "context". Any town with just a couple of people that fit the "pattern" immediately makes these mortality identifiers Personal Data. And as PaddyD mentioned, Insuretech reply to your question is everything but reassuring... remember, live people are not yet dead... even if "soon to be" :)
    – Rui Freitas Serrano
    Jun 20, 2019 at 9:56
  • Sorry with "yes you can use this data from the host company, just without regards to GDPR" I meant that I've gotten the green light from them, but they never said anything about GDPR explicitly.
    – Shhua
    Jun 20, 2019 at 10:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .