The Information Commissioner’s Office (ICO) has published draft guidance on privacy enhancing technologies (PETs), saying it will help put into practice the principle of data protection by design.
PETs are technologies that can help organisations share and use people’s data responsibly, lawfully, and securely, including by minimising the amount of data used and by encrypting or anonymising personal information. They are already used in sectors including financial services and healthcare.
The draft guidance – on which the ICO is now inviting feedback until 22 September – outlines which different types of PETs are available and their benefits.
These include homomorphic encryption, secure multiparty computation, federated learning, trusted execution environments, zero knowledge proofs and others. They can perform functions such as reducing the identifiability of individuals, hiding and shielding data, and splitting or controlling access to personal data.
The guidance also explains how they can help with data protection compliance, looking at the risks, how to do when they should be used and how to determine their level of maturity.
Announcing the publication, the ICO said PETs open up new opportunities to use data through innovative and trustworthy applications.
Safe and lawful
Information Commissioner John Edwards said: “Although the use of PETs is in its early stages, it can unlock safe and lawful data sharing where people can enjoy better services and products without trading their privacy rights. In the UK, one example is the NHS building a system for linking patient data across different organisational domains.
“Today’s draft guidance is part of my office’s strategy for the next three years, where we will be supporting the responsible use and sharing of personal information to drive innovation and economic growth. PETs have the potential to do that, so we look forward to hearing from industry and other stakeholders on how our guidance can help them achieve this.”
