Secure and Distributed Assessment of Privacy-Preserving Releases of GWAS

Genome-wide association studies (GWAS) correlate genetic variants in genomes to phenotypes, i.e., observable characteristics such as diseases, that they may cause. Privacy-preserving distributed algorithms have been designed to compute these statistical analyses. However, they have limited applicability, since judging whether a federation of genome data owners can safely release the results of these analyzes still requires the use of a centralized algorithm that determines the conditions such data can be safely released. This centralization violates privacy regulations, such as the GDPR, when the federation is distributed and spans multiple institutional and legislative domains. In particular, collusion or compromise of federation members may violate the privacy of individuals who have entrusted other members with their data. In this work, we introduce GenDPR, a collusion-tolerant, distributed middleware and architecture for computing and checking for the safe release of GWAS. GenDPR leverages trusted execution environment (TEE) to avoid transferring genomes across privacy domains and to determine which statistics to release safely. We show that GenDPR achieves the same accuracy as a centralized solution while protecting against collusions of all-but-one federation members aiming at exposing other members' genomes. Additionally, GenDPR significantly reduces the amount of transferred data, since only intermediary results are exchanged between TEEs.