Replication of scientific research: addressing geoprivacy, confidentiality, and data sharing challenges in geospatial research

Abstract

The ability to replicate, or reproduce, research is fundamental to the scientific process. Research combining a variety of georeferenced data is spreading rapidly across scientific domains and international borders. This suggests a growing potential for the use and integration of new and existing data sets to create new multi-disciplinary scientific collaborations. Yet, the unique characteristics of georeferenced data present special challenges to such collaborations. These data are highly identifiable when presented in maps and other visualizations or when combined with sensor data or other related geospatial data sets. The potential opportunities of collaboration may thus be constrained by the need to protect the locational privacy (geoprivacy) and confidentiality of subjects in research using georeferenced data. This paper reviews the obstacles to and potential methods for sharing georeferenced data in order to support a growing and dynamic geospatial research community and build capacity for data-intensive research across the social and environmental sciences. The development and implementation of a geospatial virtual data enclave methodology is proposed as an innovative and viable solution to share and archive georeferenced data among researchers while protecting the geoprivacy of research subjects and the confidentiality of these data. The ability to share confidential geospatial data among researchers is crucial to ensuring replicability of scientific research, and to enable researchers to verify and build upon the research of others.

Keywords:

• geospatial data
• geoprivacy
• virtual data enclave
• data confidentiality
• GPS/GIS
• locational privacy
• geolocation

1. Introduction

The ability to replicate and reproduce research is a cornerstone of the scientific method (McNutt 2014). Research combining a variety of intensive geographically referenced data streams is now spreading across many scientific domains, ranging from environmental science to transportation to epidemiology. Several contemporary trends are driving this research ranging from massive quantities of data streaming to data warehouses from global positioning systems (GPS)-enabled devices, sensors, and location-aware technologies, to advances in web services and cyberinfrastructure, to new geoprocessing tools for analysing, exploring, and visualizing large, multi-scale spatiotemporal data sets (Richardson 2013).

Figure 1. Point aggregation: assigning 100 points to pre-defined point locations in a unit square: (a) original pattern and (b) aggregated pattern.

Source: Armstrong, Rushton, and Zimmerman (1999).

These trends suggest a growing and exciting potential for the use and integration of new and existing data sets to create multi-disciplinary and data-intensive scientific collaborations. Yet, the unique characteristics of georeferenced data present special data sharing challenges to such collaborations, and to replication of geospatial research. These data are highly identifiable when presented in maps and other visualizations or when combined with sensor data or other related geospatial data sets. The potential opportunities and benefits of collaboration are constrained by the need to protect the locational privacy (geoprivacy) and confidentiality of subjects in research using georeferenced data.

This paper reviews the obstacles to and potential methods for sharing georeferenced data among geospatial researchers in order to support a growing and dynamic international geospatial research community and build capacity for data-intensive research across the social and environmental sciences. First, the unique confidential characteristics of large georeferenced data sets (including geospatial cyberinfrastructure and ‘big’ data) are discussed together with viable ways to manipulate these data and their geovisualizations to protect confidentiality and privacy of research subjects. Second, current methods and procedures are examined that have been used to assess and reduce disclosure risks in maps, conduct statistical analyses, and produce other research products derived from locationally identifiable data. Third, the development and implementation a geospatial virtual data enclave (GVDE) methodology for sharing and archiving confidential georeferenced research data and protecting the privacy of research subjects is proposed. The GVDE methodology would provide a secure server and protocols that enable researchers to store and conduct sophisticated analyses of sensitive geospatial data, share that data with other researchers, and apply geographic masking technologies that, once evaluated for disclosure risk, allow for publication of data and maps without disclosing sensitive information about individuals or groups. Finally, the paper argues that this approach offers the potential for innovative and viable solutions to share and archive georeferenced data among researchers while protecting the geoprivacy of research subjects and the confidentiality of these data. It can contribute to the formation of research communities by facilitating access to data and data sharing that has heretofore been difficult or impossible to access and use without sacrificing confidentiality.

2. Confidentiality issues associated with georeferenced data

In recent years, advances in geographic information system (GIS) as tools for the storage, retrieval, manipulation, analysis, and display of spatial data have led to the collection and use of enormous amounts of more precise and accurate data that also contain information on geographic locations. Georeferenced data are increasingly rich in attributes and available, from street networks to remotely sensed images, from land parcel data to disease outbreaks, and more (Richardson et al. 2013). Location and spatial patterns, processes, and relationships can offer new insights in the search for answers to important questions, particularly as the capabilities to link social survey data with geographic data improve (VanWey et al. 2005; Gutmann et al. 2008). Spatial analysis and mapping of georeferenced individual-level data can help identify important geographic patterns or lead to significant knowledge for dealing with specific social issues (Kwan 2000, 2004; Thomas, Richardson, and Cheung 2008).

However, disclosure of the locations of subjects’ homes, workplaces, daily activities, or trips may lead to serious negative consequences (Dobson and Fisher 2003; Curtis, Mills, and Leitner 2006a). This is especially true in research on public health or social issues (see Boulos, Curtis, and AbdelMalik 2009 for an overview of locational privacy in biomedical and public health research literature). For example, there is considerable interest in the effect of neighbourhood on crime, delinquency, and immigrant assimilation (Simcha-Fagan and Schwartz 1986; Brooksgunn et al. 1993; Sampson, Morenoff, and Earls 1999; Sampson, Morenoff, and Gannon-Rowley 2002; Jackson, Pebley, and Goldman 2010; Sastry and Pebley 2010; Mennis et al. 2011; Mennis and Mason 2012). Complex data collections, such as the Project on Human Development in Chicago Neighborhoods and the Los Angeles Family and Neighborhood Survey (L.A. FANS) have been designed to provide the geospatial detail needed for this kind of research. These developments, however, often raise important issues about protecting the privacy of individuals’ characteristics, attitudes, and behaviours that have been associated with precise – ‘spatially explicit’ – locations (Onsrud, Johnson, and Lopez 1994; Kwan, Casas, and Schmitz 2004; VanWey et al. 2005; Gutmann et al. 2008). Georeferenced coordinates are highly identifiable, and individuals become even more identifiable when data about them and/or their itineraries (e.g., travel to work) are available.

With the capabilities of GIS to integrate and analyse a large amount of georeferenced data and the increasing use of web-based services and cyberGIS in compiling and delivering data (Richardson 2006), the potential of GIS to be far more invasive of personal privacy than many other information technologies has caused serious concern among privacy advocates, GIS researchers, and the public (Onsrud, Johnson, and Lopez 1994; Cutter, Richardson, and Wilbanks 2003; Armstrong and Ruggles 2005; Blumberg and Eckersly 2009). The need to protect individual privacy is particularly acute because of the ethical and legal implications of disclosure of sensitive data. When a statistical population can be sufficiently narrowed to the point where one individual can be identified, statistical disclosure has been achieved (Fellegi 1972). Disclosure has the potential to violate personal privacy and data confidentiality.

Different types of location data are often collected in social research. For example, collecting continuous space-time coordinates of people’s daily lives using GPS has become more common in recent years. Location data about people’s activities and trips are also collected in many social surveys (e.g., the L.A. FANS dataset has subjects’ activity locations). Access to high-resolution, remotely sensed imagery has also become commonplace. Imagery can be readily combined with population data, along with locational information related to land use, ownership and household or individual characteristics collected from social surveys (see Liverman et al. 1998). Such locational data can be sensitive and carry considerable disclosure risk. For example, how would maps showing the locations (and addresses) of HIV-infected persons affect people living in a small community?

Different types of location data and personal information are also collected by government agencies and private companies and compiled into large databases, increasingly using ‘location-aware’ (geolocation) technologies and location-based services facilitated by GPS technology (see, for example, Armstrong and Ruggles 2005; Cottrill 2011). Blumberg and Eckersly (2009) illustrate the extent and potential of these activities with location-aware technologies such as monthly transit swipe cards, electronic tolling devices (and congestion pricing), cellphones, swipe cards to open doors, parking metres that can text you when time is running out, activity trackers which collect bio-markers such as heart rate, and services reporting what friends are near. Web technologies and social media have helped complement these data collection efforts by encouraging individuals to reveal personal information linked to specific geographic locations (geo-tagged tweets are one example).

In such a data-intensive environment, researchers using georeferenced data face several challenges. First, disclosure of detailed locational data is often illegal. Many countries have laws which govern data collection and its disclosure. On the one hand, they frequently give statistical agencies or researchers the right to collect information. On the other hand, they often require that the agency or the researcher not disclose such data in any way (Fellegi 1972). In the USA, the Privacy Act of 1974 attempted to ensure that only authorized and necessary data are collected by federal agencies and that this collection is done in a manner that would ‘preclude unwarranted intrusions upon individual privacy’ (Gordis and Gold 1980). In addition to the various legal obligations statistical agencies must abide by, many make additional representations or guarantees to respondents regarding the confidentiality of the data collected, often in an effort to obtain better response rates. For a summary of US privacy laws, including location privacy, see Pomfret (2012).

Second, disclosure can be unethical, especially when a study involves sensitive issues or human subjects that are ‘hidden, secret or concealed’ (Brown 2000, 62), since disclosing their identities or locations through mapping may put them at unforeseeable risk. Disclosure is also unethical when respondents have been previously guaranteed confidentiality. Under current Institutional Review Board (IRB) requirements at universities, researchers cannot display analytical results or maps that may lead to re-identification of subjects. These include illustrations that show the locations of subjects’ homes or workplaces (e.g., precise plots of individual space-time paths constructed with GPS data).

Third, while researchers may apply protections to the data and maps they release in response to the legal and ethical requirements described above, it is still possible that maps and other geovisualizations may unintentionally include enough information to overcome those protections. Few studies have systematically evaluated the risk of disclosure or the effectiveness of protection methods. Tests using techniques to ‘reverse-geocode’ locations on maps provide examples of potential problems. Reverse geocoding is a reverse engineering process through which the actual address of a point location in the geographic database is identified, leading to the identification of the home, work, or activity address of the subject and possibly the identification of the subject (see, for example, Armstrong and Ruggles 2005; Brownstein, Cassa, and Mandl 2006; Curtis, Mills, and Leitner 2006a). Curtis, Mills, and Leitner (2006a), using a newspaper map of body-recovery locations published in New Orleans after Hurricane Katrina, tested the potential for this ‘reverse engineering’. Even though the map was published without a road network, other features allowed them to georeference the maps, restore the road network, and locate specific houses. Ironically, geocoding has had some unintentional built-in protections due to errors (completeness and positional error) (Zandbergen 2009). However, as the accuracy of geocoding techniques improve, the chance of successfully re-engineering mapped locations has also improved (Boulos, Curtis, and AbdelMalik 2009). As a result, these researchers are calling for standards and guidelines for the display of maps derived from georeferenced data that require privacy protections (Curtis, Mills, and Leitner 2006b; Boulos, Curtis, and AbdelMalik 2009).

In addition, the potential unintended privacy consequences of matching data and maps published by researchers with large private or public sector databases described above have yet to be explored fully:

The danger of public release of information is made more complicated by the rapid increase in computing power available to all, which means that efforts at data matching and data mining that would have been unattainable … a few years ago are no longer outside the realm of possibility. (Gutmann et al. 2008, 647)

For example, address information can be potentially linked to these other databases, revealing personal information that was intended to be protected. Importantly, federal laws that deal with privacy have limited applicability to private firms (Cottrill 2011). Two recent reports issued by the US government provide an overview of current policy and technological issues relating to data privacy (Executive Office of the President 2014; President’s Council of Advisors on Science and Technology 2014).

3. Limiting disclosure risk and protecting geoprivacy: current status

There are several ways in which geoprivacy may be protected when georeferenced individual-level data are involved, ranging from regulations to specific methodologies. One approach is through more elaborate and stricter government regulation. Legislation that seeks to protect individual privacy, however, may hinder non-intrusive and socially desirable uses of georeferenced data. Onsrud, Johnson, and Lopez (1994) proposed self-regulation as a possible solution to the problem and provided a set of privacy protection guidelines. Based on a similar approach, the Urban and Regional Information Systems Association (URISA) released a ‘GIS Code of Ethics’ that provides principles and guidelines for protecting individual privacy when using GIS (URISA 2003). The National Science Foundation (NSF) supported Oregon State University, Penn State University, the University of Minnesota and the Association of American Geographers (AAG) from 2007 to 2009 in a project to develop and institute graduate seminars that rigorously explored the ethical implications of geographic information science and technology (GIS&T). Open educational resources designed and produced by a team of professional ethicists and GIS&T educators from this research project are available at http://gisprofessionalethics.org.

Besides federal law that regulates the collection and release of data collected by government agencies (and self-regulation), there are human subject protection procedures implemented by IRBs of academic institutions. While IRBs review, approve and monitor the collection and use of data in academic research involving human subjects, it is not unusual within an IRB to encounter confusion about the risks of disclosure with respect to maps and other geospatial output (Boulos, Curtis, and AbdelMalik 2009).

Several methods are also available to modify or hide the original location information embedded in maps or geovisualizations generated using georeferenced data. Geographic masks add stochastic or deterministic noise to the original data matrix through modifying the geographic coordinates of the data points (Armstrong, Rushton, and Zimmerman 1999; Kwan, Casas, and Schmitz 2004; Armstrong and Ruggles 2005; Leitner and Curtis 2006; Gutmann et al. 2008; Cottrill 2011), or what computer scientists call ‘obfuscation’ (Krumm 2009). Masking techniques hide the original location associated with particular attributes or data (e.g., data of the household or individuals at that point). By geographically masking all locations in a data set, researchers can still use illustrations that include the locations of subjects’ homes or workplaces in their maps or geovisualizations when publishing their results, while protecting the geoprivacy of the individuals represented by those points.

Examples of geographic masking methods include: aggregation, affine transformations, random perturbation, and the donut method (Armstrong, Rushton, and Zimmerman 1999; Kwan, Casas, and Schmitz 2004; Chen, Rushton, and Smith 2008; Zimmerman, Armstrong, and Rushton 2008; Hampton et al. 2010). Aggregation masks the original location through organizing data by areal units, assigning multiple individual records to one point location, or generating aggregate pattern using individual data (see Figure 1). Areal aggregations can also be achieved by using regionalization methods that construct larger areas with population or attributes more similar than census units or zip code areas (Wang, Guo, and McLafferty 2012; Mu et al. 2015). In affine transformations, the scale of the point pattern may be changed, the point locations may be shifted a determined distance and direction, or the distribution may be rotated around a chosen point a certain number of degrees (see Figure 2). A random perturbation mask allows both the amount and direction of spatial displacement to vary between points (see Figure 3). The donut method is an extension of random perturbation in which each point is relocated in a random direction by at least a minimum distance but less than a maximum distance (Hampton et al. 2010).

Figure 2. Examples of affine transformations: (a) rescaling (top) and (b) rotation (bottom).

Source: Armstrong, Rushton, and Zimmerman (1999).

Figure 3. 3D density surfaces of masked data of the geographical distribution of lung cancer deaths in Franklin County, Ohio in 1999. Left: 3D surface obtained with circular mask. Right: 3D surface obtained with weighted mask.

Source: Kwan, Casas, and Schmitz (2004).

Geographic masking techniques may be applied either to the data before analysis or to the products of research (e.g. maps) after analysis. From a data sharing perspective, researchers strongly prefer post-analysis masking. Since all masking procedures change the data in some way, pre-analysis masking may affect the results of the data analysis when analysis of georeferenced individual-level data could help identify important geographical patterns. Restricted access to individual-level data may leave many needs for understanding critical social issues unfulfilled and constrain opportunities for replication of scientific studies, as well as comparative or longitudinal studies. Few studies have examined the extent to which analytical results are affected by different methods of geoprivacy protection (especially when precise geographic locations are modified with geographic masking methods).

In this paper, we propose an alternative method to provide data for analysis in a secure environment. We call this method the GVDE, which helps researchers develop and implement procedures for accessing and sharing georeferenced data in ways that offer adequate protection of geoprivacy and confidentiality, and provides guidance on and procedures for re-distributing, re-using, and publishing georeferenced data. It will also help researchers formulate robust plans for securely archiving data and survey samples while allowing interested researchers to access and use them. We suggest that this approach has the potential to support NSF researchers in meeting the data dissemination and sharing requirements of NSF projects, helping them to prepare and implement the data management plans of their NSF projects, and providing NSF with new options to evaluate and understand data management plans involving geospatial data. IRBs will also benefit when researchers are able to demonstrate clearly how human subjects will be protected through such a GVDE methodology.

4. The GVDE methodology

While previous studies on methods for protecting geoprivacy exist (e.g., Armstrong, Rushton, and Zimmerman 1999; Kwan, Casas, and Schmitz 2004; Armstrong and Ruggles 2005; Zimmerman, Armstrong, and Rushton 2008), few studies have systematically evaluated the risk of disclosure or the effectiveness of protection these methods offer. We propose the GVDE methodology as an alternative for addressing these issues more systematically and thoroughly.

Since aggregation by fairly large administrative units (e.g., county, census tracts) is a common and established practice for protecting geoprivacy, the method we conceive here also focuses on the use of data sets that include street addresses or geographic coordinate locations at high positional accuracy (e.g., GPS data). This proof of concept research specifically addresses the following questions within the context of the GVDE: (1) What kinds of geographic masking methods (e.g., random perturbation) are suitable for which kinds of data? (2) What are the trade-offs between geoprivacy protection and accuracy of analytical results? Specifically, what values of the masking parameters offer reasonable level of geoprivacy protection without significantly affecting the results? (3) What values of the masking parameters for different masking methods can most effectively reduce the possibility of reverse geocoding (e.g., the bandwidth to use in kernel density estimation)? (4) What kind of cartographic output or maps (e.g., the standard deviational ellipse (SDE) or the kernel density surface (KDS), and at what scale, can be released publicly to researchers or used in publications? (5) What are the computing and physical constraints and limitations for conducting advanced geospatial analyses within the geospatial digital enclave environment?

The GVDE is designed to allow researchers to access and analyse georeferenced data while protecting the confidentiality of subjects. In a virtual data enclave (VDE), all data and analysis take place on a server in a secure data centre. Users of the VDE open a connection to a ‘Virtual Machine’ (VM) running on a server in the data centre, and communicate with the VM via client software installed on their local computer. The VM is isolated from the user’s physical desktop computer, restricting the user from downloading files or parts of files to their physical computer. The VM is also restricted in its external access, preventing users from emailing, ftp’ing, copying, or otherwise moving files outside of the secure environment, either accidentally or intentionally. The secure environment has high-level access controls and firewalls in place to prevent unauthorized access to data from outside sources, and communication between the data centre and the user is encrypted. The GVDE approach also has significant advantages in terms of accessibility, cost, and ongoing usage over existing methods which require researchers to travel to secured physical sites in order to view or access confidential data.

The VDE presents the user with a familiar desktop operating system with all the functionality of a standard PC, but computing occurs on the server rather than the local machine. Users perform their analyses as they normally would, and they obtain output by depositing it in a ‘drop box’, where it can be checked for disclosure risks before being sent to them. Systems of this sort have been developed in the USA and a number of countries for access to data underlying government statistics. But this paper, to the best of our knowledge, is the first that conceives the application of this technology in light of the unique challenges of georeferenced identifiable data.

This GVDE methodology supports a wide range of statistical and spatial analysis techniques that are used by researchers in various disciplines: social statistics, spatial statistical techniques for area-based data, and geospatial methods for point-based data. Examples of the kinds of analysis that can be supported include the following.

4.1. Social statistics

Since summary statistics and statistical results normally do not reveal the identity of subjects or any locational information that risks violating geoprivacy, all commonly used social statistical techniques can be supported in the GVDE. These include multiple regression, principal component analysis, cluster analysis, factor analysis, multidimensional scaling, discriminant analysis, contingency table analysis, general linear models, survival analysis, log-linear models, multi-level models, and structural equation models.

4.2. Spatial statistical techniques for area-based data

Since area-based geographic data are already aggregated at different spatial scales (e.g., county, census tracts), all geospatial analytical techniques for area data can be supported in the GVDE together with procedures to ensure that the aggregation level is adequate for geoprivacy protection. These techniques include various area-based measures of spatial association and spatial cluster analysis methods (e.g., Anselin’s (1995) local indicator of spatial association (LISA), Moran’s I, Geary’s C, and Getis’s Gi), and a suite of spatial regression models.

4.3. Geospatial methods for point-based and linear data

Researchers in various disciplines now collect detailed space-time data of subjects using GPS and other location-aware devices (e.g., smart phones) (e.g., Wiehe et al. 2008; Maddison et al. 2010; Rainham et al. 2010; Troped et al. 2010; Zenk et al. 2011). These data sets contain accurate and continuous locational information that can be used to construct the daily space-time trajectory of the subject, and thus can be used to identify the subject and the location of his/her home, workplace, and daily activities. An individual’s activity space, for example, is the area containing all georeferenced locations with which an individual has direct contact as a result of the sequence of his or her activities. Activity spaces can be generated and revealed using the SDE, the KDS, and the potential path area (PPA) methods. The SDE captures the geographic distribution or directional trend of a series of points (Yuill 1971; Arcury et al. 2005; Wong and Lee 2005; Rainham et al. 2010). The KDS is a density surface (e.g., population density) derived from the location of a set of points using a kernel function and a predetermined search radius (or bandwidth). The PPA is the area that a subject can reach given his or her daily space-time constraint (e.g., fixed locations like workplace) (Kwan 1998, 1999).

Since point-based and linear geographic data can reveal the location of subjects’ home, workplace, or activity locations, these data sets pose particularly high risks of disclosure and geoprivacy violations. Many spatial statistical methods that use point-based data are available that generate results that normally do not reveal the original point locations of the data set. These methods include geographically weighted regression, kriging, spatial point pattern analysis, spatial cluster analysis, the spatial scan statistic, kernel density estimation, and the K function. However, in desired data sharing situations, researchers may need to see the original point locations during the analytical process (e.g., to assess visually the spatial distribution of the points). The GVDE thus accommodates a set of procedures for visualizing these point locations while preventing disclosure of the identity of the subjects, masking the point locations and evaluating cartographic output to examine the effect of different parameters (e.g., bandwidth and impedance functions that model the effect of distance decay) on disclosure risks, and testing the robustness of these procedures and deciding the level of protection required to prevent the possibility of reverse geocoding.

5. Implementation

The Inter-university Consortium for Political and Social Research (ICPSR) at the University of Michigan has developed a VDE system for use with other forms of data. The AAG and the ICPSR have received an NSF-funded joint project to apply their complementary research expertise to develop and implement the GVDE methodology outlined in the previous section. The project is developing solutions to long-standing problems of sharing geospatial data and their visualizations, and building capacity for data-intensive geospatial research across the social and environmental sciences.

Specifically, research on the following areas has been conducted through this AAGICPSR joint project: (1) research on the unique confidential characteristics of large georeferenced data sets (including issues associated with geospatial cyberinfrastructure and ‘big’ data), and on viable ways to manipulate these data and their geovisualizations to protect confidentiality and privacy of research subjects; (2) research on methods and procedures to assess and reduce disclosure risks in maps, statistical analyses, and other research projects derived from locationally identifiable data; (3) research regarding the viability of sharing and archiving confidential georeferenced research data, including the exploration, development, and testing of cost-effective and potentially far-reaching procedures and technology using a VDE to enable sophisticated analyses of these data under conditions that protect the privacy of research subjects; and (4) engaging representatives from multiple research communities that utilize georeferenced data to (a) intensively test confidentiality methods and procedures within the GVDE to reduce disclosure risk and (b) assist in developing standards and specifications for disclosure review that can be further tested to address the unique characteristics of georeferenced data.

To evaluate the GVDE, researchers from multiple geospatial research communities which deal with georeferenced data and regularly encounter privacy and confidentiality issues uniquely related to geographic information and data have been recruited to test it. They are working within the GVDE to analyse different kinds of georeferenced data sets; apply and work with different masking techniques and potentially identify customized software extensions or applications that are needed; and identify, explore, test, and assess the range of different visualization outputs or extractions related to disclosure risk. Their usage patterns are monitored and their feedback, experiences, and needs regularly recorded. Input from this research community is helping to formulate training materials for future users of the GVDE system and methods.

Sample use cases for the GVDE include many geographic and geospatial technology tools and data collection practices which generate questions about locational privacy and confidentiality such as research involving personal travel itineraries, geographical information and data related to health (including m-health initiatives), or those involving minors or at risk populations, among many others.

6. Conclusion

Advances in GIS and related technologies have provided new and increasingly powerful tools for researchers to visualize and analyse a wide range of phenomena, and they are particularly useful for integrating data across domains of the natural and social sciences. New research designs are being developed to take advantage of the ubiquity of devices with integrated real-time interactive global positioning system and geographic information system capabilities and new geolocation technologies for both mobile and environmental sensors. These developments, however, raise important issues about protecting the privacy of subjects or other individuals who have provided confidential information. Georeferenced coordinates are highly identifiable, and individuals become even more identifiable when their individual locations (e.g., home or work) and itineraries (e.g., travel to work) are available. These issues are further complicated by the existence of large and growing corporate databases that capture and store real-time locational information about individuals and their surroundings that can be mined and matched with research data.

The inherent identifiability of georeferenced data makes it difficult for researchers to share their data, which reduces scientific replication opportunities, secondary analysis, and increases the costs of research. Restrictions on the re-use of data are particularly burdensome for students and early-career researchers, who may not have the resources to collect data themselves. The innovative GVDE methodology described in this paper (a) provides researchers with full and secure access to unmodified georeferenced data, while assuring the protection of human subjects, (b) enables publication of research results (e.g., maps) to which disclosure protections have been applied, and (c) allows researchers to satisfy both human subject protections guidelines and NSF data management and data sharing requirements. Unlike alternative approaches, which involve introducing noise or creating simulated data prior to release of sensitive data (and hinder collaboration), researchers using the GVDE may gain access to unmodified georeferenced data. The confidentiality of subjects can be protected while sharing data among researchers by developing and applying disclosure protection methods and standards to the products of research – maps and other geovisualizations – rather than to the inputs to the research process.

The GVDE methodology described in this paper and the ongoing AAG and ICPSR research program will contribute to the development and implementation of a new methodology for sharing and using confidential georeferenced data in a wide variety of research contexts. These contributions include: (1) advances in understanding the unique confidential features of large georeferenced data sets and how to analyse and manipulate these data and their geovisualizations to protect confidentiality and geoprivacy of research subjects; (2) progress in developing procedures and standards to assess and reduce disclosure risks in georeferenced data, maps, statistical analyses, and other research products derived from locationally identifiable data with input from research communities that utilize geospatial data; (3) development and testing of a GVDE system designed specifically for analysis of georeferenced data; (4) outlining of training materials needed to help educate researchers about ways that re-identification of subjects can occur and safe ways to present their results and protect georeferenced information; (5) review of the requirements of NSF data management plans in order to inform our current research regarding researchers’ needs in preparing these plans; and (6) development of a sustainable model for building scalable and fully operational VDE facilities for georeferenced data at ICPSR.

Further, specific application areas are poised to benefit from the development and use of the GVDE methodology in light of their current research trajectories. These areas include, for example, the increasing use of geographic technologies in health research and the growing awareness of the importance of geographic context to health behaviour and outcomes (Kwan 2012). As disclosure protection is extended to a wide array of analytical methods beyond static output, the potential to develop new geovisualization tools that are interactive or dynamic (screens/slices) will be greatly enhanced. The development of automatic disclosure protection for real-time spatiotemporal data will enable the use of these data in many real-time or near real-time applications, including crowdsourcing. New opportunities also exist for integrating research developments around the GVDE methodology with emerging cyberinfrastructure research agendas to meet the needs of researchers to share and archive these confidential data and to enable researchers around the world to replicate and build upon scientific research involving geospatial data.

Disclosure statement

No potential conflict of interest was reported by the authors. The content is solely the responsibility of the authors and does not necessarily represent the official views of the NIH or the NSF.

Acknowledgements

We would like to thank and acknowledge permission to reprint Figures 1 and 2 from John Wiley & Sons, Ltd. (Copyright © 1999) and Figure 3 from University of Toronto Press (Copyright © 2004).

Additional information

Funding

This research was supported in part by the National Cancer Institute of the NIH [grant number R13CA162823] and the US National Science Foundation [grant number BCS-1244691].