Any privacy-protecting transformation applied to the linked location after the spatial join, which changes the recorded location of the exposure (none / deterministic geographic jitter / suppression / aggregation to a coarser unit / stochastic perturbation). A linkage-stage concern: the transform is applied when the ambient value is attached to a person, so the value ultimately carried may be the value at a perturbed rather than the true location. A deterministic hex-reassignment jitter is the motivating case.
Tier: recommended
Why this slot matters
A privacy transform applied AFTER the spatial join changes the recorded location of the exposure, so a downstream analyst cannot tell a faithfully-linked value from a privacy-perturbed one; the ambient value attached to a person may be the value at a reassigned location, not the true one. Recording the transform is what keeps that perturbation declared rather than silent — and it is a linkage-stage concern, squarely in the layer EnVar defers to whoever performs the person-join.
In plain terms
To protect privacy, a pipeline may deliberately move, blur, or drop a person's location after matching them to environmental data — so the value they end up with may be the value at a nearby place, not their real one. This records whether such a change was made and of what kind, so the perturbation is visible instead of hidden.
URI: envar:slot/privacy_transformation
Applicable Classes
| Name |
Description |
Modifies Slot |
| LinkageMethod |
How a gridded environmental value gets attached to a patient: the resolution ... |
no |
Properties
Type and Range
Cardinality and Requirements
Examples
| Value |
| deterministic_geographic_jitter |
| none |
Annotations
| property |
value |
| tier |
recommended |
| justification |
A privacy transform applied AFTER the spatial join changes the recorded location of the exposure, so a downstream analyst cannot tell a faithfully-linked value from a privacy-perturbed one; the ambient value attached to a person may be the value at a reassigned location, not the true one. Recording the transform is what keeps that perturbation declared rather than silent — and it is a linkage-stage concern, squarely in the layer EnVar defers to whoever performs the person-join. |
| explanation |
To protect privacy, a pipeline may deliberately move, blur, or drop a person's location after matching them to environmental data — so the value they end up with may be the value at a nearby place, not their real one. This records whether such a change was made and of what kind, so the perturbation is visible instead of hidden. |
| covered_by |
None |
Schema Source
Mappings
| Mapping Type |
Mapped Value |
| self |
envar:privacy_transformation |
| native |
envar:privacy_transformation |
LinkML Source
name: privacy_transformation
annotations:
tier:
tag: tier
value: recommended
justification:
tag: justification
value: A privacy transform applied AFTER the spatial join changes the recorded
location of the exposure, so a downstream analyst cannot tell a faithfully-linked
value from a privacy-perturbed one; the ambient value attached to a person may
be the value at a reassigned location, not the true one. Recording the transform
is what keeps that perturbation declared rather than silent — and it is a linkage-stage
concern, squarely in the layer EnVar defers to whoever performs the person-join.
explanation:
tag: explanation
value: To protect privacy, a pipeline may deliberately move, blur, or drop a person's
location after matching them to environmental data — so the value they end up
with may be the value at a nearby place, not their real one. This records whether
such a change was made and of what kind, so the perturbation is visible instead
of hidden.
covered_by:
tag: covered_by
annotations:
omop_gaia:
tag: omop_gaia
annotations:
extent:
tag: extent
value: absent
status:
tag: status
value: asserted
where:
tag: where
value: no column
note:
tag: note
value: The heat-scenario GAIA/OMOP join carries the true geocoded location
with no privacy-transformation record on location.csv or external_exposure.csv.
degauss:
tag: degauss
annotations:
extent:
tag: extent
value: absent
status:
tag: status
value: asserted
where:
tag: where
value: no column
note:
tag: note
value: DeGAUSS runs inside the institution and emits the true geocoded
location; no privacy transform is recorded in its CSVs.
amadeus:
tag: amadeus
annotations:
extent:
tag: extent
value: absent
status:
tag: status
value: asserted
where:
tag: where
value: no column
note:
tag: note
value: Amadeus extracts at the true request coordinates with no privacy-transformation
record.
cher:
tag: cher
annotations:
extent:
tag: extent
value: full
status:
tag: status
value: asserted
where:
tag: where
value: C-HER hex-reassignment privacy jitter (small-population hex → largest
hex in same ZIP3)
note:
tag: note
value: C-HER applies the deterministic hex-reassignment privacy jitter
this slot models — it is the motivating case.
codata:
tag: codata
annotations:
extent:
tag: extent
value: out_of_layer
status:
tag: status
value: asserted
where:
tag: where
value: no column
note:
tag: note
value: A post-join privacy transformation is an instance-layer linkage
step, outside CODATA's conceptual scope.
description: 'Any privacy-protecting transformation applied to the linked location
*after* the spatial join, which changes the recorded location of the exposure (`none`
/ deterministic geographic jitter / suppression / aggregation to a coarser unit
/ stochastic perturbation). A linkage-stage concern: the transform is applied when
the ambient value is attached to a person, so the value ultimately carried may be
the value at a perturbed rather than the true location. A deterministic hex-reassignment
jitter is the motivating case.'
title: Privacy Transformation
examples:
- value: deterministic_geographic_jitter
description: the participant is reassigned to the largest hex in the same ZIP3 when
the true hex's ZIP3 population is small
- value: none
description: no privacy transform applied; the linked location is the true one
from_schema: https://w3id.org/linkml/microschemas/envar
rank: 1000
domain_of:
- LinkageMethod
range: PrivacyTransformationEnum