The latest development in the PETs space

As we enter 2023, there is increased talk on privacy enhancing technologies from industry, government, and regulators.

Privacy enhancing technologies (PETs) are “an emerging set of technologies and approaches that enable the derivation of useful results from data without providing full access to the data”[i]. PETs are increasingly important due to their ability to unlock data insight without putting individuals at risk.

For example, PETs are particularly useful in the financial sector where they help with financial crime detection and prevention. In order to identify collusion or fraudulent transactions it is necessary that data is shared in a way that safeguards individuals’ personal data.

As technologies develop around PETs, so does the guidance and regulation surrounding them. In the last six months, we have seen significant development in PETs guidance. In February 2023, the United Nations published a guide on PETs for official statistics. Earlier guidance efforts include the Information Commissioner’s Office (ICO) draft guidance on PETs, published in September 2022.

Yet further guidance can be found in the recent report by The Royal Society, which takes a look at six PETs and summarises recommendations for future development. This is made up of:

• trusted execution environments
• homomorphic encryption
• secure multi-party computation
• federated learning
• differential privacy
• privacy-preserving synthetic data

There is increased recognition of the importance of PETs by government bodies. The UK and US governments are delivering a set of prize challenges related to PETs. First announced in December 2021, the winners of Phase 1 were announced in November 2022 and the winning solutions will be shared this spring. The aim of the challenges is to accelerate the adoption and development of PETs.

With PETs being a novel set of technologies, the need for standardisation is being increasingly recognised. For example, synthetic data is a PET which consists of algorithms trained to create artificial datasets that retain the statistical value of the real data, but none of the sensitive information. Since this new, synthetic dataset does not contain any Personal Identifying Information (PII) it is not subject to GDPR restrictions, and it is safe to share both internally and with external partners.  

Synthetic data is a powerful technology but if poorly executed it could either reduce data utility or worse – result in data leakage. The need for standards in the space is ever more pressing as there is likely to be more use of SD in near future since Gartner has predicted that by 2024, 60% of the data used for the development of AI and analytics projects will be synthetically generated.

At Hazy, we recognise this need and are proud to be part of a recently set up Synthetic Data Industrial Connections Group at IEEE. We would like to extend an invitation to synthetic data experts to join the group. The aim is to gather relevant knowledge and expertise in one place, contributing to the creation of best practices and standards for the quality use of synthetic data. We also responded to the call for input by the Financial Conduct Authority who published the synthetic data call for input feedback statement last week. This is an exciting time in the space with an opportunity to set the standards for ethical data processing.

We are happy to see so much going on in the PETs space: technology vendors pushing boundaries of what is possible and support from government and regulatory organisations. Best practices, standardisation, and appropriate regulation are signs of a technology’s maturation. To ensure PETs are being used safely and most effectively, there needs to be regulation and clear detailed guidance that rules out any misinterpretation. At Hazy we are keen to ensure that the PETs we are using mature into the best and safest versions of themselves. 

To find out more about how Hazy software uses differential privacy in our processes, watch our video.

[i] The Royal Society report From privacy to partnership (January 2023)