data security mobile phone

The Evolution of Data Privacy: A Q&A with Bojil Velinov, Head of DevOps & Automation at Luna 


Bojil Velinov, Head of DevOps & Automation at Luna, talks about the evolution of data privacy and how Luna is addressing privacy and data security at the company.

From your perspective, how has the conversation on data privacy evolved, and how are you addressing it at Luna?

Data privacy is moving more and more into mainstream conversation, from breaches of social media sites and data leaks to ransomware attacks at medical institutions. Some of our utmost personal information is stored in these places, so it becomes very intimate when such information falls outside of our control. 

Bojil Velinov
Bojil Velinov, Head of DevOps & Automation at Luna

On the professional side, at the last Amazon Web Services annual re:Invent conference, the people I met with and the talks I attended combined my interests in healthcare, regulatory compliance, and data governance. The apparent perspective is that the industry is increasingly focusing on protecting the data subject, which is the technical term for whom the collected data is about. I want to see this topic continue to get more attention.

How are you addressing data privacy at Luna?

We address data privacy and security in multiple ways. We operate by embedding “privacy-by-design” as part of our core values, and we recognize that online privacy needs to be built upon a foundation of data security measures. 

For example, one best practice we have is conducting yearly penetration tests, a type of security test that ensures our application stack is well protected against some of the most common attacks on the internet. It’s one of the ways we work to secure our platform. 

We also assess the risk(s) for every software feature, such as a login button, entry for one’s username, file uploads, and such. As part of our development process, we ask ourselves: “How do we prevent this feature from being vulnerable to attack?” Implementing detection, prevention, and recovery pieces into each assessed feature is part of our development life-cycle. By exercising due diligence in our design, development, and release processes, we keep the application stack more secure–and ultimately guard privacy.

How do you operationalize privacy-by-design at Luna?

It’s good to think outside the box, such as what possible future attacks on the software could occur. For example, how do we architect a way to be resilient to future vulnerabilities? One way is to utilize continuous integration and deployment (CI & CD) coupled with monitoring tools, security brainstorming sessions and vulnerability scans. 

We’ve taken privacy and security into account very seriously, and from the inception of the platform, one approach we utilize, for example, is envelope encryption–it’s a way to encrypt something in multiple layers. You can envision this as putting a box within a box, but imagine if each was locked within each one, and they have separate keys to unlock them. 

Another approach we have taken is not storing the data in the same location. We keep data fragmented. This way, if one particular location is compromised, it doesn’t reveal the complete picture of what the data represents. 

People who contribute to the Luna platform see how their data is utilized and to some degree magnified. That starts with our language and how we talk about it, it goes through how we implement the guards of that data and finishes with the granular controls of the data we give to each individual. All this establishes trust and demonstrates transparency. 

People have become increasingly aware of the importance of data security and how it affects data privacy. The volume of personal data people generate on the internet pertains to their privacy and their ownership of that particular data. I think what we do often try to put ourselves in the user’s perspective. People who contribute to the Luna platform see how their data is utilized and to some degree magnified. That starts with our language and how we talk about it, it goes through how we implement the guards of that data and finishes with the granular controls of the data we give to each individual. All this establishes trust and demonstrates transparency. 

Can you share more about the penetration test?

There are various ways of having a good posture from a security perspective. For example, how do we ensure our domain or company email is not used by a third party for spoofing? 

Pretend that a bad actor is phishing, for example. In phishing, a technique of fraudulently obtaining private information, email is the most common media. Nowadays there are some “geeky” mechanisms at our disposal, such as using specific signatures in the domain name system (DNS) records. Historically, DNS are the servers that help us find things on the internet. They are the ones knowing where you need to “land” when typing a website name in your browser’s address bar. Now, the same system is utilized to protect us from spam and phishing by allowing the receiver to check that an email claimed to have come from a specific domain was indeed authorized by the owner of that domain. This is technically known as DomainKeys Identified Mail (DKIM).

Here’s how it works:  You send an email from lunadna.com to a recipient using Gmail, for example. Upon receiving that email, the Gmail server checks for a setting in the lunadna.com  domain system. It says, “I am receiving this from this particular email service/server, can you confirm the server is authorized to send emails on your behalf?” Simple, yet powerful. I highly recommend any engineer involved with their company’s email and DNS to set this up. 

Many sites today use multi-factor authentication. What are the concepts here?

The concepts are evolving in multi-factor authentication. The tools around them are evolving. At Luna, we try to balance the impact of “extra steps” the member must take and their overall sign-in experience. At the same time, be upfront in explaining why we are putting such controls in place. In short, it’s because we really care for your data security, and we want to ensure that the person entering the platform is indeed you.

Take, for example, the case of ransomware attacks. The breaches in most of these security incidents, at various companies or individual accounts, happen because the password was compromised. That’s really the weakest link in the chain. It’s best not to reuse your passwords! Try using password manager technology to be most data safe. If one of your accounts gets compromised, bad actors can try it on other sites. If you did not reuse your password, you’d be less vulnerable. If you did, then you are out of luck.

Multi-factor authentication, in some cases referred as 2FA, can be leveraged in different ways, such as using email verification, text message, etc. It’s that additional control you put in place that, to some degree, provides another layer of protection. It also has its vulnerabilities, though. 

A practical way to think about multi-factor authentication is to balance the work required for authenticating the user to keep the bad guys out while keeping the process user-friendly. You don’t want to annoy your new participants with a slew of controls before they can see the benefit of your application. A little friction goes a long way, and it’s certainly better than the pain associated with sensitive data loss. 

Read about Luna’s Data Protection Impact Assessment.


About Luna

Luna’s suite of tools and services connects communities with researchers to accelerate health discoveries. With participation from more than 180 countries and communities advancing causes including disease-specific, public health, environmental, and emerging interests, Luna empowers these collectives to gather a wide range of data — health records, lived experience, disease history, genomics, and more – for research.

Luna gives academia and industry everything they need from engagement with study participants to data analysis across multiple modalities using a common data model. The platform is compliant with clinical regulatory requirements and international consumer data privacy laws.

By providing privacy-protected individuals a way to continually engage, Luna transforms the traditional patient-disconnected database into a dynamic, longitudinal discovery environment where researchers, industry, and community leaders can leverage a range of tools to surface insights and trends, study disease natural history and biomarkers, and enroll in clinical studies and trials.


phone security

The Role of Cybersecurity in the Management of Data Privacy


The focus on data privacy from the general public has surged over the past few years. A large cohort of individuals with little to no experience in informatics now needs to understand the digital environment at a level of detail beyond their expertise or experience.

The intersection between privacy and the much more common issues concerning data security and data breaches has resulted in a digital environment where few can make confident and informed decisions. As a result, most individuals conflate data security with the privacy policies in place.

The differences between data security and data privacy

Data security features are measures that allow an individual or an organization to exert control over a digital asset. Security is typically implemented in overlapping layers to minimize the likelihood that control or access to a digital asset will be lost. End users most obviously experience security through password-mediated access control, possibly with a second level of identity verification such as a code sent to a mobile phone via text for identity confirmation. There are also many security safeguards put in place at the infrastructure level to avoid unauthorized access by programmatic “hacking.” Collectively, all these cybersecurity features provide a foundation for control of a digital asset.

In contrast, data privacy is a set of policies layered on top of controlled digital assets. Data privacy can be expressed as a set of rights guaranteed to an individual to access, correct, share, un-share, restrict, transport, and delete their digital assets. Data privacy equally requires a level of transparency around the processing or use of data so the individual can exercise those rights in an informed manner. Absent data security measures to exert control, data privacy policies cannot be implemented.

The intersection between privacy and the much more common issues concerning data security and data breaches have resulted in a digital environment where few can make confident and informed decisions. As a result, most individuals conflate data security with the privacy policies in place.

Data privacy policies need to persist over the lifetime of a digital asset whereas data security features are temporal. Once access is given by satisfying all security safeguards, all control of the data asset by the owner is lost. Data privacy rights require a persistent environment that provides data security to prevent external access while allowing agreed use of the data asset for approved purposes. 

Scott Kahn
Scott Kahn, PhD, Chief Information and Privacy Officer, Luna

Playing in the sandbox

The use of such securely isolated environments called “sandboxes” supports independence between the individuals (i.e. data users) gaining access to digital assets in the sandbox and the inclusion of digital assets in the sandbox by the data owners. This effectively maintains a level of control over the data asset by the data owner even as the asset is being used or processed within the sandbox by the data users.

There are many new data privacy policies being enacted into law around the world that, to a greater or lesser extent, confer data rights to data owners. The European Union has enacted the General Data Protection Regulation (GDPR), which serves as an exemplar for many countries outside of the EU and for several states within the U.S. But regardless of the data privacy policies in place, all privacy controls are built upon a cybersecurity foundation of data security measures that support control of data assets within a digital environment.

The interplay between security control and an implemented set of privacy policies takes center stage within the Luna platform. 

Security controls are reviewed via SOC 2 protocols that are documented and audited on a regular basis. Data privacy policies are reviewed regularly and assessed with regard to the data rights conferred to individuals and to the potential risks to these individuals incurred by sharing their data. 

Data privacy impact assessments (DPIAs) are performed for the Luna platform and for the sandboxes employed by researchers. It’s noteworthy that within the Luna platform the full spectrum of research inquiry is supported while simultaneously supporting the data privacy rights of all individuals willing to share their health data to advance medical science.

Read about Luna’s Data Protection Impact Assessment.


About Luna

Luna’s suite of tools and services connects communities with researchers to accelerate health discoveries. With participation from more than 180 countries and communities advancing causes including disease-specific, public health, environmental, and emerging interests, Luna empowers these collectives to gather a wide range of data — health records, lived experience, disease history, genomics, and more – for research.

Luna gives academia and industry everything they need from engagement with study participants to data analysis across multiple modalities using a common data model. The platform is compliant with clinical regulatory requirements and international consumer data privacy laws.

By providing privacy-protected individuals a way to continually engage, Luna transforms the traditional patient-disconnected database into a dynamic, longitudinal discovery environment where researchers, industry, and community leaders can leverage a range of tools to surface insights and trends, study disease natural history and biomarkers, and enroll in clinical studies and trials.


Scott Kahn, Ph.D.

Scott Kahn, Ph.D.

CHIEF INFORMATION + PRIVACY OFFICER

Scott is the former CIO and VP Commercial, Enterprise Informatics at Illumina. At Luna, he’s integrating data privacy and security provisions that keep member data safe, private, and secure.


How Modern Data Privacy Laws Enables Research


Now that data privacy laws have become more globally widespread, existing institutional systems for data aggregation have been slow to adapt to support general health research.

In this webinar, Luna’s Chief Information and Privacy Officer, Scott Kahn, explores the common framework of General Data Protection Regulation (GDPR) and related regulations and suggests a path forward through privacy-by-design research.


About Scott Kahn

Scott Kahn, PhD. is the Chief Information and Privacy Officer at Luna, a private investor-owned company founded in November 2017. The public benefit corporation is chartered to drive societal value through the aggregation and organization of genomic and health data at a scale and diversity rich enough to solve today’s greatest health challenges. LunaPBC founded LunaDNA, the world’s first community-owned health database that offers shares of ownership to health data contributors. Scott is integrating data privacy and security provisions that comply with GDPR and HIPAA at LunaDNA. Scott is also on the Board of Directors at Rady Children’s Institute for Genomic Medicine and was the former Chief Information Officer and Vice President Commercial, Enterprise Informatics at Illumina. 

About Genetic Alliance

Genetic Alliance, a non-profit organization founded in 1986, is a leader in deploying high-tech and high-touch programs for individuals, families, and communities to transform health systems by being responsive to the real needs of people in their quest for health. The alliance is comprised of 10,000 organizations, 1,200 of which are disease and patient advocacy foundations, and include community health programs, employee wellness programs, local nonprofits, religious institutions, and community-specific programs to grow and expand their reach and mission.