Empowering User Confidentiality Through PETs | Insights From the ABBYY Perspective

Strengthening Privacy Rights with Privacy Enhancing Technologies

Andrew Pery

November 15, 2018

More rigorous privacy regulations such as the EU GDPR and a number of US privacy initiatives such as the recently ratified California Consumer Privacy Act impose higher standards on data controllers and processors to safeguard privacy rights – including data subject consent management, accommodating data subject requests, data portability and more onerous data controller and processor accountability standards.

Moreover, there seems to be momentum developing for a more comprehensive US Federal Privacy initiative consistent with GDPR. The current US data privacy regime is somewhat fragmented and sectoral in nature and is perceived to be an impediment to competing in the digital economy. Congress appears to be responding to these challenges. There are several proposed legislative initiatives under consideration, in particular:

the Consent Act the ambition of which is to “establish privacy protections for customers of online edge providers. These protections include requiring edge providers to notify customers about the collection and use of “sensitive customer proprietary information.”; and
Social Media Privacy Protection and Consumer Rights Act “that would allow users to opt out of tracking, simplify legalese, and require platforms to notify users of a data breach within 72 hours.”

These initiatives are also endorsed by the technology sector , including Google, Facebook and Microsoft. In particular, Google has recently published a Framework for Responsible Data Protection Regulation that espouses broader data subject rights, provides for enhanced transparency, accountability and provisions for privacy by design embedded in software that enables data subjects to exercise greater control over their privacy settings.

The sense of urgency by organizations to implement technological and organizations measures that mitigate compliance risk is accelerating. A recent AIIM survey found that while prior to GDPR coming into force only 30% of organizations were fully compliant with GDPR, after the deadline 50% of same organizations surveyed indicated that they are 75% compliant.

The survey surfaced several business-critical areas where potential compliance risks are high:

Discoverability of personal information across distributed file shares, email systems and content repositories;
Challenges associated with information classification that identifies personally identifiable information;
Lack of ability to respond to data subject requests in a timely manner and which is consistent with the GDPR requirement to respond within 30 days of the request .
Respond to audit requests and breach response readiness in line with the 72 hour breach notification requirement; and
Review and remediation of all existing Data Processing Agreements and obligations analysis relating to consent management and data controller and processor agreements.

A recent survey by IAPP and Trust Arc highlighted the investment priorities in privacy enhancing technologies which are consistent with the pain points of the AIIM survey. Investment priorities focus on:

Data Mapping
Personal Data Discovery
De-identification
Consent Management; and
Content Analytics (Privacy Information Management)

In a previous blog I’ve covered data mapping and data discovery technologies. One of the more vexing challenges for organizations is to strike a balance between the social utility of AI based content analytics technologies and safeguarding privacy rights particularly data subject profiling. Technological innovation such as always-on mobile devices and wearable technologies the rapid advancement of geolocation technology and predictive analytics create a digital fingerprint of data subject biographical information about their preferences and behavior.

The commercial incentive to share data for secondary uses with third parties is compelling as it promotes innovation. The social utility of personally identifiable information spans health care delivery and public services so long as the information is properly de-identified . De-identification consists of several algorithms designed to remove personal information. Generally, there are two forms of de-identification: pseudonymization, which removes the association and personal data is replaced by one or more artificial identifiers and anonymization that removes the association between the identifying dataset and the data subject in a manner whereby re-identification is not possible. The applicability of these two de-identification alternatives depends on the intended secondary uses of the data, the sensitivity of the data and the associated risk of re-identification. A particularly useful guide for the application of de-identification technologies and best practices is the National Institute of Standards and Technology (NIST) De-Identification of Personal Information .

There are also emerging efforts to incorporate privacy by design principles into content analytics technologies intended to profile data subjects. At the recently held 40th International Conference of Data Protection and Privacy Commissioners released its Declaration on Ethics and Data Protection in Artificial Intelligence the ambition of which is to ensure that “Artificial intelligence and machine learning technologies should be designed, developed and used in respect of fundamental human rights and in accordance with the fairness principle, in particular by:

“Considering individuals’ reasonable expectations by ensuring that the use of artificial intelligence systems remains consistent with their original purposes, and that the data are used in a way that is not incompatible with the original purpose of their collection
taking into consideration not only the impact that the use of artificial intelligence may have on the individual, but also the collective impact on groups and on society at large; and
ensuring that artificial intelligence systems are developed in a way that facilitates human development and does not obstruct or endanger it, thus recognizing the need for delineation and boundaries on certain uses.”

About the author: Andrew Pery is a marketing executive with over 25 years of experience in the high technology sector focusing on content management and business process automation. Andrew holds a Masters of Law degree with Distinction from Northwestern University is a Certified Information Privacy Professional (CIPP/C) and a Certified Information Professional (CIP/AIIM).

This article originally appeared in AIIM.org entitled “Strengthening Privacy Rights with Privacy Enhancing Technologies” by Andrew Pery. To read the original version, please visit: https://info.aiim.org/digital-landfill/strengthening-privacy-rights-with-privacy-enhancing-technologies .

Intelligent Document Processing (IDP) Data Privacy Legal Artificial Intelligence (AI)

Andrew Pery

Digital transformation expert and AI Ethics Evangelist for ABBYY

Andrew Pery is an AI Ethics Evangelist at intelligent automation company ABBYY . His expertise is in artificial intelligence (AI) technologies, application software, data privacy and AI ethics. He has written and presented several papers on the ethical use of AI and is currently co-authoring a book for the American Bar Association. He holds a Masters of Law degree with Distinction from Northwestern University Pritzker School of Law and is a Certified Information Privacy Professional (CIPP/C), (CIPP/E) and a Certified Information Professional (CIP/AIIM).

Connect with Andrew on LinkedIn .

First name*

E-mail*

Сountry*

СountryAfghanistanAland IslandsAlbaniaAlgeriaAmerican SamoaAndorraAngolaAnguillaAntarcticaAntigua and BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelgiumBelizeBeninBermudaBhutanBoliviaBonaire, Sint Eustatius and SabaBosnia and HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean TerritoryBritish Virgin IslandsBrunei DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman IslandsCentral African RepublicChadChileChinaChristmas IslandCocos (Keeling) IslandsColombiaComorosCongo (Brazzaville)Congo, (Kinshasa)Cook IslandsCosta RicaCroatiaCuraçaoCyprusCzech RepublicCôte d’IvoireDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe IslandsFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHeard and Mcdonald IslandsHoly See (Vatican City State)HondurasHong Kong, SAR ChinaHungaryIcelandIndiaIndonesiaIraqIrelandIsle of ManIsraelITJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKorea (South)KuwaitKyrgyzstanLao PDRLatviaLebanonLesothoLiberiaLibyaLiechtensteinLithuaniaLuxembourgMacao, SAR ChinaMacedonia, Republic ofMadagascarMalawiMalaysiaMaldivesMaliMaltaMarshall IslandsMartiniqueMauritaniaMauritiusMayotteMexicoMicronesia, Federated States ofMoldovaMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNetherlands AntillesNew CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk IslandNorthern Mariana IslandsNorwayOmanPakistanPalauPalestinian TerritoryPanamaPapua New GuineaParaguayPeruPhilippinesPitcairnPolandPortugalPuerto RicoQatarRomaniaRwandaRéunionSaint HelenaSaint Kitts and NevisSaint LuciaSaint Pierre and MiquelonSaint Vincent and GrenadinesSaint-BarthélemySaint-Martin (French part)SamoaSan MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSint Maarten (Dutch part)SlovakiaSloveniaSolomon IslandsSouth AfricaSouth Georgia and the South Sandwich IslandsSouth SudanSpainSri LankaSurinameSvalbard and Jan Mayen IslandsSwazilandSwedenSwitzerlandTaiwan, Republic of ChinaTajikistanTanzania, United Republic ofThailandTimor-LesteTogoTokelauTongaTrinidad and TobagoTunisiaTurkeyTurks and Caicos IslandsTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUnited States of AmericaUruguayUS Minor Outlying IslandsUzbekistanVanuatuVenezuela (Bolivarian Republic)Viet NamVirgin Islands, USWallis and Futuna IslandsWestern SaharaZambiaZimbabwe

I have read and agree with the Privacy policy and the Cookie policy .
I agree to receive email updates from ABBYY Solutions Ltd. such as news related to ABBYY Solutions Ltd. products and technologies, invitations to events and webinars, and information about whitepapers and content related to ABBYY Solutions Ltd. products and services.

I am aware that my consent could be revoked at any time by clicking the unsubscribe link inside any email received from ABBYY Solutions Ltd. or via ABBYY Data Subject Access Rights Form .

Referrer

Last name

Query string

Product Interest Temp

UTM Campaign Name

UTM Medium

UTM Source

ITM Source

GA Client ID

UTM Content

GDPR Consent Note

Captcha Score

Page URL

Connect with us

Solve Marvelous

Empowering User Confidentiality Through PETs | Insights From the ABBYY Perspective