A PETs Castle on a Foundation of Sand
Privacy Enhancing Technologies: A Closer Look at Foundational Challenges
Privacy Enhancing Technologies (PETs) have been trumpeted as the cornerstone of secure data sharing and processing.
However, the enthusiasm surrounding PETs often glosses over the shaky foundation upon which they stand: perfect privacy preservation isn’t possible, necessary, or sufficient.
The mantra of "protect privacy so you can share your data," accompanied by whitepapers and research on technical re-identification risks, does not address the real challenges inherent in safeguarding data in use.
The Real Job of PETs
Sharing data and secure computation is not just a technical problem – it is usually a legal one. How can you satisfy all of the technical and legal requirements with new technologies? Let’s take a look at some of the considerations:
- Expertise in Method-Specific Risks: Understanding the nuances of different privacy-enhancing methods and their associated risks is crucial. PETs must delve deep into these methodologies, evaluating their strengths and weaknesses in protecting data.
- Legal Context Integration: PETs cannot operate in a vacuum. They must be situated within the relevant legal frameworks, ensuring that their application complies with existing data protection regulations and anticipates future legislative trends.
- Robust Assessment Processes: The development of comprehensive third-party assessment methodologies to evaluate the efficacy, reliability, and legality of privacy protections is essential. These processes must be transparent, rigorous, and adaptable to changing data landscapes.
- Indemnification of Customers: Trust is the currency of PETs. Providing indemnity to customers, thereby assuming responsibility for potential breaches caused by the PET provider, underscores a commitment to the security and integrity of the technologies offered..
Navigating the Claims of Privacy
PET vendors too often focus on technical privacy protections, while outsourcing the accompanying legal questions to their customers. This requires each client to answer the following questions:
- Are the technical safeguards in this whitepaper sufficient to reduce our legal risk?
- Under what configurations and circumstances can we trust these technical protections?
- For any individual use case, are we using the technology for risk reduction? Or compliance?
This increases the costs, complexity, and risks of deploying and relying on a vendor’s technology, and leads to a diffusion of standards, evaluations, and legal opinions about the sufficiency of each method and approach.
PET vendors are in a position to provide deeper evaluations of their technology, realize economies of scale in performing rigorous legal and technical audits, and create consistent evaluation criteria across clients. Why would clients be responsible for building these foundational elements themselves?
Technology is insufficient to address privacy problems at enterprise-scale unless it’s supported by a foundational legal - technical - risk analysis that customers can rely on.
How can organizations navigate the promises and pitfalls of PETs to ensure that their data privacy measures are both effective and grounded in the reality of running a business in the real world?
