Appunta
AI for Humanity, privacy Tech/PPML, Responsible AI, PETs, AI Governance, Security• Community advocate • Bridging the world between privacy, policy, and IT
Today, Information Commissioner's Office published its Guidance on Privacy-Enhancing Technologies for Data Protection Compliance, aiming to provide assistance to data protection officers (DPOs) and individuals handling large personal data sets in various sectors such as finance, healthcare, research, and government. The guide is divided into two parts: Part I is geared towards DPOs and covers the application of PETs in achieving compliance, Part II targets a more technical audience, providing an overview of eight types of PETs along with their associated risks and benefits: Differential privacy, Synthetic data, Homomorphic encryption, Zero-knowledge proofs, Trusted execution environments, Secure multiparty computation, Private set intersection, and Federated learning. Some key findings: - PETs can help you demonstrate a ‘data protection by design and by default’ approach to your processing. - PETs can help you comply with the data min imisation principle. You can do this by only processing the information you need for your purposes. - PETs can also provide an appropriate level of security for your processing. -You can use PETs to give people access to datasets that would otherwise be too sensitive to share, while ensuring people’s information is protected. - Most PETs involve processing personal information. Your processing still needs to be lawful, fair and transparent. - You should identify the risks to people by performing a case-by-case Assessment of the processing (eg through a data protection impact Assessment (DPIA)). This will determine if PETs are appropriate to mitigate those risks. - You should not regard all PETs as a way to anonymise personal information. Not all PETs result in effective anonymisation, and you can achieve anonymisation without using them. The ICO points out that by leveraging PETs, organizations can gain valuable insights from datasets without compromising individuals' privacy, even with sensitive data that would otherwise be challenging to share. Nevertheless, lack of expertise in implementing and utilizing PETs can lead to mistakes in implementation and a poor understanding of how to achieve the desired balance between privacy and utility. To tap into the benefits of PETs, organizations should consider involving experts or vendors with sufficient expertise in PETs. Insufficient expertise can result in inappropriate implementation which may compromise the intended protection. Additionally, lacking appropriate organizational measures can significantly undermine the effectiveness of PETs, as some PETs rely on trusted 3rd parties, and assurances rely on organizational controls, contractual obligations, monitoring, and auditing. Therefore, organizations should ensure they have the necessary expertise and appropriate organizational measures in place to leverage the full potential of PETs while protecting individuals' rights and freedoms effectively. #PETs #ICO
