# Genomic data privacy platforms

Re-identification from a few dozen SNPs, surname inference and long-range familial search, and the specific cost each cryptographic answer charges: ciphertext expansion, communication rounds, and a finite privacy budget.

A genome cannot be anonymised, and it is not only yours — which is why privacy here is cryptography rather than redaction.

Source: https://en.bioecon.ru/docs/services-governance-capital/digital-it/genomic-data-privacy-platforms/
Updated: 2026-09-04



Every other privacy regime starts by stripping identifiers. Genomics cannot, because the data is the identifier. That single fact explains why this field builds cryptography instead of redaction policies.

## Why a genome is not anonymisable

A genome is a lifelong unique key. Work by Lin, Owen and Altman in 2004 established that on the order of 30 to 80 independent common variants are enough to distinguish one person from everyone else — a vanishing fraction of the millions a genotyping array reports. Removing a name changes nothing: the record still matches its owner whenever any other sample from them exists.

Three results made this concrete. Homer and colleagues showed in 2008 that an individual's presence in a pooled cohort could be detected from published aggregate allele frequencies alone, which prompted the removal of GWAS summary statistics from open access. Gymrek and colleagues showed in 2013 that Y-chromosome short tandem repeats could be matched against recreational genetic-genealogy databases to infer a surname, and that surname plus age and state was often enough to name a research participant. And long-range familial search generalises the attack: because relatedness is detectable out to third cousins, a database covering only a small percentage of a population can yield a match for most of that population — the basis of forensic genetic genealogy.

Two consequences follow that no consent form removes. A genome implicates relatives who never consented, including those not yet born; and unlike a credit card it cannot be reissued after a breach.

## What each cryptographic answer costs

**Homomorphic encryption** allows computation directly on ciphertext, so an untrusted host computes without ever holding plaintext. The cost is arithmetic: ciphertexts are far larger than the values they hide, each operation is orders of magnitude more expensive than its plaintext equivalent, and the number of chained multiplications is bounded before noise growth requires an expensive bootstrapping step. It is therefore practical for narrow, pre-agreed computations — allele frequencies, a specific variant test, a defined risk score — and not for exploratory genome-wide analysis. The iDASH secure genome analysis competitions have tracked exactly where that boundary sits.

**Secure multiparty computation** splits the data so no party holds a usable share, and the parties jointly compute the result. Its cost is communication rather than computation: protocols need many rounds, so bandwidth and latency between institutions dominate. It suits a few known collaborators on a good network and degrades badly across many parties or continents.

**Differential privacy** takes the opposite approach, adding calibrated noise so that any single participant's presence cannot be inferred from an output. Its cost is a budget. The privacy parameter is consumed by every query and does not renew, so a dataset supports a finite number of honest answers before its guarantee is spent. Worse for genomics, the noise required scales badly for rare variants — precisely the signal that rare-disease work depends on.

**Federated analysis** moves the computation instead of the data, and is the most deployable of the four. But its outputs are summary statistics, which is exactly what Homer's attack read, so federation is an access-control architecture that still needs one of the above applied to what leaves it. The GA4GH Beacon protocol is the compact illustration: a service answering only "is this allele present, yes or no" was shown to leak membership under repeated querying, and had to be repaired with budgets and noise rather than with a stricter answer format.