Privacy Enhancing Technologies (PETs): Data Protection Meets Innovation

The data protection law does not define PETs; however, The European Union Agency for Cybersecurity (ENISA) refers to PETs as: ‘software and hardware solutions, i.e. systems encompassing technical processes, methods or knowledge to achieve specific privacy or data protection functionality or to protect against risks of privacy of an individual or a group of natural persons.’1 In simple terms, they are strategies and tools designed at safeguarding privacy and empowering individuals. These technologies represent data protection principles such as minimising the use of personal data, security, and confidentiality principle, and protecting data subjects.

PETs help organisations to achieve outcomes without the need to access or share individuals' data. This approach not only safeguards against data misuse but also allows for the analysis of information as though the original data were directly available to them. Moreover, this enables organisations to comply with both data minimisation as well as security principles of privacy laws.

PETs support compliance with the Data Protection by Design and Default requirements, providing a strong advantage in the market by highlighting their commitment to data protection and safeguarding individual’s privacy rights at every stage of the process.

PETs are a great way of implementing technical measures which reduces the identifiability of the individual either by hiding or shielding the information. This approach not only helps organisations adhere to security principles but also reduces the risk of potential data breaches.

PETs can be categorised based on the type of privacy they protect, either input privacy or output privacy. Input privacy focuses on processing without accessing personal data, accessing only intermediate values, or employing techniques that use observable channels during processing to produce a result. For instance, secure multiparty computation (SMPC) which allows two parties to jointly process their combined data using a cryptographic method known as secret sharing. This technique breaks the information into fragments and distributes them among the parties. On the other hand, PETs which provide output privacy mitigate the risks from the information as an outcome of the processing. This is useful if an organisation wants to share anonymous data publicly or share the result of any analysis. For example, differential privacy, people's privacy in a dataset is protected by making sure that no one can figure out if any individual’s data is in the dataset, even when the data is being used for analysis. It provides a mathematical guarantee that the inclusion or exclusion of any single person's data won't significantly change the results of the analysis, keeping their information private.

Moreover, PETs can also be categorised in other ways, including:

• PETs that minimise or remove identifiability.

• PETs that shield or hide information.

• PETs that split datasets.

• PETs that minimise or remove identifiability Let’s take an example, when a hospital shares data with a researcher to study patterns related to a particular disease, it's unnecessary to reveal any personal details. The hospital could create synthetic data using differential privacy techniques to anonymise the original data, which would still allow the researcher to identify trends. However, organisations must first understand their objectives before choosing which PETs to implement. This synthetic data, though useful for research, cannot be used in patient treatment, where individual health data is essential.

• PETs that shield or hide information Techniques like homomorphic encryption and zero-knowledge proof are helpful in protecting the privacy and obtaining the desired results without actually revealing the original data. Using homomorphic encryption helps in computation on the encrypted text, similarly zero knowledge proof is beneficial to prove the outcome without demonstrating the actual information.

• PETs that split datasets Considering the security and confidentiality of the data, these PETs minimise the risk of linking information across different datasets. The technology is designed in a way that every aspect is defined, from data collection to how each system interacts. This structure ensures that the information is separated and prevents other applications from accessing personal data. An interesting technique called federated learning where multiple parties work together to train AI models using their own local data. Instead of sharing the actual data, they exchange only specific patterns which contribute to creating a global model without sharing any training information with each other.

As per the ICO, below are some identified PETs:

• Secure multiparty computation

• Homomorphic encryption

• Differential privacy

• Zero-knowledge proofs

• Generating synthetic data

• Federated learning

• Trusted execution environments

• Synthetic data

• Private set intersection

PETs are an effective way of enhancing privacy and protecting the data subjects, however every opportunity brings its own challenges which require strategic planning and considerations. Some difficulties associated with PETs are below:

• Lack of expertise: Since PETs are relatively new, organisations often lack the necessary expertise, requiring them to invest in understanding the resources and training needed to effectively implement these technologies.

• Implementation challenges: The lack of expertise can lead to improper implementation of the technology and processes, creating potential risks that may remain unidentified. Therefore, it is crucial for organisations to consistently monitor the use of these technologies.

• Lack of policies and procedures: Since PETs are a relatively new concept, many organisations have not yet developed the necessary policies or procedures to ensure streamlined use. Additionally, aspects such as legal obligations, organisational controls, and auditing mechanisms are still under development.

• Technical oversight: PETs, like any other emerging technology can be risky. Any risks, oversights, or errors related to their implementation should be treated with the same level of attention and caution as those associated with other technologies.

As reliance on data is growing at a rapid pace, PETs are an effective way for organisations to protect individuals’ privacy and comply with data protection laws. However, considering the current state of such technologies are quite new, it is also important to understand the drawbacks and bring a risk-based approach before implementing them.

Organisations need to clearly understand the purpose of processing and the stages in the process where PETs can be applied before making a decision. Different PETs serve different purposes, and the most suitable ones are those that align with the organisation's goals while also adhering to data protection principles. Before implementing any PETs, it is important to conduct a DPIA to evaluate the data protection risks, assess the maturity of the technology, and consider the costs associated with using the technology or process.