What are PETs?

Privacy Enhancing Technologies (PETs) are a category of technologies capable of enabling, enhancing, and preserving data privacy concerns throughout the data lifecycle. They largely depend on the use of a data-centric approach for security and privacy.¹ A data-centric approach to data security is focused on the information that needs protection instead of the network, device or application.² Policymakers consider PETs as technical tools or methods for achieving compliance with data protection requirements or legislations. Generally, policymakers imply the functionality of PETs in unison with different organizational measures, including personnel management and access controls, audits, information security policies, and procedures.³

This nascent set of technologies, combined with changes in wider policy and business frameworks, could enable greater sharing and use of data in a privacy preserving, trustworthy manner. This could create new opportunities to use datasets without creating unacceptable risks. It also offers great potential to reshape the data economy, and to change, in particular, the trust relationships between citizens, governments and companies.⁴

Popular PETs and their Use cases

PETs can be broadly categorised as:⁵ tools that alter the data; tools that obscure data, by hiding or shielding data; and new systems and data architectures for processing, managing, and storing data with privacy in mind. Below are three examples of the new age PETs that are currently deployed, alongside their real-life applications:

1. Homomorphic encryption enables computational operations on encrypted data without decryption of that data.⁶ The original information (data in the clear, plaintext or cleartext data) is not revealed. The result of the computation is also encrypted, and needs to be decrypted (transformed back into plaintext) to see the results.⁷ Enveil, a PETs company, has partnered with DeliverFund, a counter-human trafficking intelligence organisation, to use homomorphic encryption based technology to provide access to a large human trafficking database in the US. Users of the platform will be able to cross-match and search on DeliverFund’s database without revealing the contents of their search or compromising the security of the data they are searching on.⁸

2. Differential privacy where data is anonymized via injecting noise (meaningless data) into the dataset studiously. It allows data experts to execute all possible (useful) statistical analysis without identifying any personal information.⁹ The goal of differential privacy is to add enough random, additional data so that real information is hidden amidst the noise.¹⁰ Differential privacy is better suited for larger databases due to the diminishing effect of a particular individual on a particular aggregate statistic alongside growth in the number of individuals in the database.¹¹ In 2017, the US Census Bureau announced that it would be using differential privacy as the privacy protection mechanism for the 2020 decennial census. By incorporating formal privacy protection techniques, the Census Bureau will be able to publish a specific, higher number of tables of statistics with more granular information than previously.¹²

3. Secure Multi-party computation (SMPC) is a distributed computing system or technology capable of offering abilities for computing values of interest.¹³ SMPC takes input from multiple encrypted data sources without any party revealing private data to others.¹⁴ Therefore, SMPC has the potential to enable joint analysis on sensitive data held by several organisations.¹⁵ French-American startup, Owkin, is using Federated Learning to build a score that predicts the severity of a patient’s COVID-19 prognosis, and these scores support several hospitals in resource management and planning at the frontline.¹⁶

Benefits and Limitations of PETs

PETs, as discussed above, have various manifestations,benefits and limitations. The table below generally summarizes the qualitative and quantitative benefits that entities can expect to experience from the deployment of PETs.¹⁷

Despite the wide range of benefits that emanate from the use of PETs, there are various limitations that have prevented PETs from being a pragmatic solution to privacy concerns faced by data processing entities.

Universal limitations to the use of PETs can be surmised as the following:¹⁸

1. Lack of internal capacity and expertise within entities to deploy and manage complex PET solutions;

2. PETs are at varying stages of maturity and research. The variability in maturity and research adds to the complexity of PET adoption and makes it harder for firms to determine which PETs are appropriate and what resources they need to deploy; and

3. PETs do not automatically offer a complete guarantee that the entity deploying the tool or technique is in compliance with its data protection obligations. Enhanced PETs can be reversed or compromised, therefore PETs still need to be treated like any technical implementation, with oversight and management around use, access, and security

PETs and the Kenya Data Protection Act

The use of PETs by data processing entities in Kenya has the potential to enhance the utility of the data while simultaneously fulfilling the entities key data protection obligations. The Kenyan Data Protection Act (DPA) was enacted in November 2019 and is guided by the principles of data protection.¹⁹ Amongst the key obligations created is the responsibility for every data controller or data processor to implement data protection by design or by default. Privacy by design refers to the philosophy and approach of embedding privacy into the design specifications of various technologies, including the adoption and integration of privacy-enhancing technologies (PETs).²⁰

The DPA offers entities discretion in determining the technical and organisational measures deployed by taking into consideration, amongst other factors, the cost of processing data and the technologies and tools used.²¹Under the DPA, this encompasses the use of appropriate technical and organisational measures which are designed to implement the data protection principles in an effective manner; and to integrate necessary safeguards for that purpose into the processing.²² This obligation is further reinforced by the draft Data Protection (General) Regulations which stipulates that a ‘data controller or data processor shall, throughout the lifecycle of processing of personal data, design technical and organizational measures to safeguard and implement the data protection principles’.²³

Kenyan entities that possess the necessary resources to benefit from the application of PETs can utilise resources such as the Centre for Data Ethics and Innovation – PETs adoption guide.²⁴ The guide is primarily aimed at technical architects and product owners working on projects that involve the sharing or processing of sensitive information, and seeks to support decision-making around the use of PETs by helping the user explore which technologies could be beneficial to their use case.²⁵

Conclusion

PETs are at the forefront of the revolution of how data driven organisations are conducting their business operations. The obligation to adopt and use privacy by design measures under the Kenyan DPA indicates the opportunity for Kenyan entities to select and implement PETs that are most suitable to meet their organisation’s policy objectives and targets.²⁶