<p>Yes, definitely identifiable. The combination of ~80 unlinked common SNPs can be fairly unique in the entire human population, let alone the whole VCF file.</p>
<p>EDIT: 30 in the original answer is an underestimate. We need ~80 unlinked common SNPs to uniquely identify every individual to a low false positive rate. Here is the derivation based on the approximate solution to the <a href="https://en.wikipedia.org/wiki/Birthday_problem#Approximations" rel="nofollow noreferrer">birthday paradox</a>.</p>
<p>For simplicity, we assume each person has a haploid genome. Then the genotype at each SNP can only be 0 or 1. Suppose there are <span class="math-container">$n$</span> people in the world and we have <span class="math-container">$m$</span> sites. On the condition that <span class="math-container">$n^2\ll 2^{m+1}$</span>, the probability of seeing any two people having the same binary genotypes across all <span class="math-container">$m$</span> sites is
<span class="math-container">$$p(n,m)\approx 1-e^{-n^2/2^{m+1}}\approx n^2/2^{m+1}$$</span>
There are <span class="math-container">$n\approx2^{33}$</span> people. Then <span class="math-container">$p(2^{33},72)&lt;1\%$</span>.</p>
<p>In reality, we are diploid, so each genotype has three states instead of two. This would lead to a smaller <span class="math-container">$m$</span> at the same false positive rate. On the other hand, selected SNPs are not totally random. This would lead to a larger <span class="math-container">$m$</span>. It is safer to choose a larger <span class="math-container">$m$</span>.</p>

CC BY-SA 4.0
2021-06-28T22:30:44.087Z
2021-06-29T17:30:49.313Z
2021-06-29T17:30:49.313Z
user172818
<p>Not only are they theoretically identifiable based on the combination of SNPs as others have said (you are more or less identifiable from ~20 well chosen microsats) - but it's possible to be actually identified from your data using a long-range familial search, based on genetics and a bit of sleuthing.</p>
<p><a href="https://science.sciencemag.org/content/362/6415/690.abstract" rel="nofollow noreferrer">https://science.sciencemag.org/content/362/6415/690.abstract</a></p>

CC BY-SA 4.0
2021-06-29T11:06:19.487Z
2021-06-29T11:06:19.487Z
user438383
<p>There should be someone at your workplace you can ask about this, but I would say, yes, since there can be SNPs in there that are private, or even a combination of public SNPs might be identifying, it should be treated as potentially identifying.</p>

CC BY-SA 4.0
2021-06-28T20:23:00.687Z
2021-06-28T20:23:00.687Z
swbarnes2
<p>TLDR: yes! be careful with someone's genomic data!</p>
<p>There are two aspects to this question: can I find a match for a random VCF in a database of genomes (YES) or can I identify a subject who is not in a (public) database.</p>
<p>But even when it may not possible to identify the subject itself, using DTC genetic testing sites may enable you to identify (close or distant) relatives (e.g. read about the <a href="https://en.wikipedia.org/wiki/Joseph_James_DeAngelo#Arrest_and_trial" rel="noreferrer">Golden State Killer</a>). Identifying relatives brings you close to identifying the individual, and also those relatives may not be pleased with learning that <a href="https://en.wikipedia.org/wiki/Henrietta_Lacks#Consent_issues_and_privacy_concerns" rel="noreferrer">the variants of someone with who they share (a small or larger part) of their genome are accessible by anyone</a>.</p>
<p>We are further ahead for some traits than others, but for more and more human characteristics we will be able to predict e.g. eye color, height based on genome data, or at least estimate to some degree. Genetic ancestry and biological sex are trivial. Often genomic data is from a patient with a (rare) disorder, further narrowing down the options.</p>
<p>In addition, there is a difference between &quot;can someone be identified today&quot; (which is definitely possible but maybe tough) and &quot;given that the variants are out there (online) forever can someone be identified within 10 years&quot; and the answer to the latter part is a loud yes.</p>

CC BY-SA 4.0
2021-06-29T07:43:24.023Z
2021-06-29T11:45:56.667Z
2021-06-29T11:45:56.667Z
Wouter De Coster
<p>This question is to be read in the context of data protection. It seems to be common understanding that the whole genome sequence of an individual is personally identifiable, non-anonymizable information: if you possess the whole genome sequence, you can without any doubt identify an individual. You also cannot anonymize it, because you would need to obstruct the genome sequence in some way, making it useless for any diagnostics or research.</p>
<p>But how about Variant Calling files (specifically referring to the <a href="https://www.internationalgenome.org/wiki/Analysis/vcf4.0/" rel="nofollow noreferrer">VCF file format</a>)? You reference against a known genome, but you neglect structural changes such as translocations, duplications and deletions. Can you still identify a person based on a Variant Calling file?</p>

CC BY-SA 4.0
2021-06-29T10:06:34.293Z
What makes you think a VCF cannot contain structural variants? Of course it can. This doesn't really affect the answer to your question, a VCF of small vairants from even a whole exome analysis is more than enough to identify an individual under certain circumstances, but there is no reason why the VCF cannot also contain translocations and indels.
terdon
CC BY-SA 4.0
2021-06-29T16:05:28.403Z
@terdon My superficial research. If a VCF contains also structural variants, the answer to my question is even clearer.
Eekhoorn
<vcf><variant-calling>
Are variant calling files personally identifiable information?
# Are variant calling files personally identifiable information?

(Asked by: username_0 on 2021-06-28)

This question is to be read in the context of data protection. It seems to be common understanding that the whole genome sequence of an individual is personally identifiable, non-anonymizable information: if you possess the whole genome sequence, you can without any doubt identify an individual. You also cannot anonymize it, because you would need to obstruct the genome sequence in some way, making it useless for any diagnostics or research.

But how about Variant Calling files (specifically referring to the [VCF file format](https://www.internationalgenome.org/wiki/Analysis/vcf4.0/))? You reference against a known genome, but you neglect structural changes such as translocations, duplications and deletions. Can you still identify a person based on a Variant Calling file?

**Tags:** vcf, variant-calling
> **Comments:**
> **username_1**: What makes you think a VCF cannot contain structural variants? Of course it can. This doesn't really affect the answer to your question, a VCF of small vairants from even a whole exome analysis is more than enough to identify an individual under certain circumstances, but there is no reason why the VCF cannot also contain translocations and indels.  
> **username_0**: @terdon My superficial research. If a VCF contains also structural variants, the answer to my question is even clearer.  

---

## 4 answers

### Answer by username_5 on 2021-06-29. Score: 10 | Accepted answer

TLDR: yes! be careful with someone's genomic data!

There are two aspects to this question: can I find a match for a random VCF in a database of genomes (YES) or can I identify a subject who is not in a (public) database.

But even when it may not possible to identify the subject itself, using DTC genetic testing sites may enable you to identify (close or distant) relatives (e.g. read about the [Golden State Killer](https://en.wikipedia.org/wiki/Joseph_James_DeAngelo#Arrest_and_trial)). Identifying relatives brings you close to identifying the individual, and also those relatives may not be pleased with learning that [the variants of someone with who they share (a small or larger part) of their genome are accessible by anyone](https://en.wikipedia.org/wiki/Henrietta_Lacks#Consent_issues_and_privacy_concerns).

We are further ahead for some traits than others, but for more and more human characteristics we will be able to predict e.g. eye color, height based on genome data, or at least estimate to some degree. Genetic ancestry and biological sex are trivial. Often genomic data is from a patient with a (rare) disorder, further narrowing down the options.

In addition, there is a difference between "can someone be identified today" (which is definitely possible but maybe tough) and "given that the variants are out there (online) forever can someone be identified within 10 years" and the answer to the latter part is a loud yes.


---

### Answer by username_2 on 2021-06-28. Score: 9

Yes, definitely identifiable. The combination of ~80 unlinked common SNPs can be fairly unique in the entire human population, let alone the whole VCF file.

EDIT: 30 in the original answer is an underestimate. We need ~80 unlinked common SNPs to uniquely identify every individual to a low false positive rate. Here is the derivation based on the approximate solution to the [birthday paradox](https://en.wikipedia.org/wiki/Birthday_problem#Approximations).

For simplicity, we assume each person has a haploid genome. Then the genotype at each SNP can only be 0 or 1. Suppose there are $n$ people in the world and we have $m$ sites. On the condition that $n^2\ll 2^{m+1}$, the probability of seeing any two people having the same binary genotypes across all $m$ sites is
$$p(n,m)\approx 1-e^{-n^2/2^{m+1}}\approx n^2/2^{m+1}$$
There are $n\approx2^{33}$ people. Then $p(2^{33},72)<1\%$.

In reality, we are diploid, so each genotype has three states instead of two. This would lead to a smaller $m$ at the same false positive rate. On the other hand, selected SNPs are not totally random. This would lead to a larger $m$. It is safer to choose a larger $m$.


---

### Answer by username_3 on 2021-06-29. Score: 4

Not only are they theoretically identifiable based on the combination of SNPs as others have said (you are more or less identifiable from ~20 well chosen microsats) - but it's possible to be actually identified from your data using a long-range familial search, based on genetics and a bit of sleuthing.

<https://science.sciencemag.org/content/362/6415/690.abstract>


---

### Answer by username_4 on 2021-06-28. Score: 2

There should be someone at your workplace you can ask about this, but I would say, yes, since there can be SNPs in there that are private, or even a combination of public SNPs might be identifying, it should be treated as potentially identifying.


---

