Privacy Engineering

GDPR Principles: Lawfulness

• Any processing of personal data must be explicitly legitimised – either by legal admission or by individually given consent.

• sufficiently specific in matters of
• data,
• purpose(s) and
• controller,
• to be given freely and unambiguously,
• to be based on a well-informed decision.

GDPR Principles: Purpose Limitation

• Personal data may only be processed for the explicit and well-specified purposes it was originally collected for.
• It may also be used for other purposes as long as these are “compatible” with the initial one, whereas compatibility of purposes depends on various factors that must be taken into account on a per-case basis.

GDPR Principles: Data Minimisation (incl. necessity)

• data processed limited to the absolute minimum necessary for fulfilling the intended purposes
• this includes:
  • amount of data
  • “person-relatedness”
  • number of parties able to access it.

GDPR Principles: Transparency

• Data subjects must be provided with easily intelligible information about the conditions framing the processing of personal data.
• this includes information about
  • data categories,
  • purposes,
  • storage durations,
  • safeguards,
  • functioning of automated decision-making and profiling.

GDPR Principles: Accuracy

• Personal data must be accurate and kept up to date. Data subjects shall be provided with means for letting inaccurate data about them be rectified, completed, deleted, or – in case of accuracy being contested temporarily blocked.
• Only means that are reasonable with regard to the purpose of processing must actually be implemented.

GDPR Principles: Security - Confidentiality, Integrity, Availability (CIA)

• Personal data must be subject to appropriate technical and organizational security measures directed at established security goals like confidentiality, integrity, or availability.
• The appropriateness of a certain security measure, in turn, depends on multiple further factors, particularly including the costs of implementation.

Security - CIA:

• Confidentiality,

• Integrity,

• Availability

GDPR Principles: Accountability

• The controller is responsible for implementing appropriate required privacy measures and must be able to demonstrate having done so.

GDPR Principles: Data Portability

• Data subjects must be able to 
• receive the personal data relating to them and provided by them 
• from the controller 
• in a „structured, commonly used and machine-readable format“.

GDPR Principles: Enforcement

• Regulations are enforced by independent supervisory authorities, usually called data protection authorities.
• These may carry out 
  • in-depth on-premise audits, 
  • issue warnings, 
  • order corrective measures, 
  • and/or impose serious administrative fines.

GDPR Principle +1:

• By Design and by Default
• Appropriateness of cost & effort

What is Privacy?

• Privacy as a “Right to be let alone”
• Privacy as “Controlling the Public Perception of Oneself”
• Privacy as “Controlling the Flow in Information”
• No “one single valid” definition -> essentially contested concept

8 Privacy Design Strategies (Little Blue Book)

• Minimise personal data
  • select only what is needed (whitelist)
  • exclude broadly (blacklist)
  • strip as soon as possible - even partial data
  • destroy thoroughly
• Separate - client-side processing, peer-to-peer, multi-party-computation
• Hide personal data and interrelationships- encrypted, mix, …
• Aggregate - process at the highes level of aggregation and with the least possible data - dynamic granularity, k-anonymity, l-diversity, …
• Inform the data subject - P3P, privicons, data breach notifications, algorithmic transparency, focus on Human Computer Interfaces, …
• Control given to the Data Subject - consent mechanism, privacy dashboard, …
• Enforce - purpose-based access control, sticky policies, …
• Demonstrate compliance - privacy mgmt systems, logging, auditing, …

5 Usable Privacy Goals:

• Transparency
• Legibility
• Relevance
• Choice
• Agency

Usable Privacy Goals - Transparency: 

• making clear what & why of data collection

Usable Privacy Goals - Legibility

• making data practices comprehensible to potential users

Usable Privacy Goals - Relevance

• making data practices relevant to those it concerns in the context of service use

Usable Privacy Goals - Choice:

• providing understandable choices regarding access and use of data to help users make an informed decision

Usable Privacy Goals - Agency:

• providing visible controls that are easy to locate, understand and action - to support decision-making and setting preferences

Compute a shared result via multiple parties without revealing the individual inputs

• in theory possible for all functions
• performance strongly limited
• chose use-cases wisely, limit use to the absolute minimum

Property-Preserving Encryption

• Order-preserving Encryption: a > b -> enc(k, a) > enc(k, b)
• Partial Order-Preserving Encoding (POPE): DB sorts entries into trees for relevant attributes, sorting done via oracle on the client-side (is enc(a) > enc(b)?)
• Fully Homomorphic Encryption: enc(a) + enc(b) == enc(a+b) and other math calc’s 
  • calculations on encrypted values
  • building blocks for and- & xor-gatter -> building an emulated cpu
  • serious bad performance

Differential Privacy

• enough noise to not be able to lern anything about a specific new data point (“student x”): p <= (e^eps) * p’
• accurate enough to provide useful results
• Global DP: DB has clear text data, noise is added upon query
• Local DP: noise is added client-side before being aggregated

Situations where one party has more knowledge than the other

• Proactive, not Reactive
• Privacy as Default Setting
• Privacy Embedded into Design
• Full Functionality - Positive Sum, not Zero Sum
• End-to-End Security - Full Lifecycle Protection
• Visibility and Transparency
• Respect for User Privacy - Keep it User-Centric

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’)

Principles as pair-wise opposites:

• Transparency vs Unlinkability
• Confidentiality vs Availability
• Integrity vs Intervenability

data rendered anonymous in such a manner that the data subject is not or no longer identifiable.” (rec. 26 GDPR)

“the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately” (Art. 4 (5) GDPR)

Table X satisfies k-anonymity if and only if each sequence of identifying values (⟶ quasi-identifier) appears with at least k occurrences in X

Data are depersonalized / aggregated in a way ensuring that each set / group contains at least L different “sensitive” values

relevant, because only ‘appropriate’ methods have to be used (Appropriateness of costs & efforts)

• Relevance: result has relevance
• Repeatability: can be run again with same result
• Fairness: systems / software compared equally
• Verifiability: result is verifiable
• Economical feasibility: resulting costs are affordable

• Identify relevant parameters & trade-offs 
• Reduction of parameter design space 
• Preference ordering 
• Experiment planning 
• Experiment execution
• Result analysis

performance impact interesting, more interesting: how expensive would it be to keep the performance at the same level?