TNO PET explorer - Set intersection

PET Questionnaire

Previous answer in PET Questionnaire edit

1What is the type of problem?

Set intersection

The type of problem Set Intersection can be either a subproblem of any of the other problems, or a problem by itself. An example of the second scenario is when organizations wish to match their datasets without planning to perform a specific analysis per se. In this case, only the Set Intersection route shall be traversed. On the contrary, when additional analysis is intended, the tree shall be traversed twice: once for Set Intersection and once for said analysis (Machine Learning, Statistical Analysis or Synthetic Data Generation).

2Can the identifiers be shared between the parties?

The most straightforward way to match the databases would be to share common identifiers of some sort. However, it is not always possible to do so as this would allow each party to know which subject the other parties own, even if the identifiers themselves are pseudonymized.

§4.2: GDPR principles and PET (integrity and confidentiality)

Guide reference

GDPR principles in relation to PETs

In the schedule below we provide insight how the PETs that are suggested in the decision tree can help to contribute to fulfilling a data protection principle set out in the GPDR. We also give insight how this relates to the use of the Decision Tree and what expertise you might need to consult in your organisation if you wish to proceed in applying a PET.

Principle/obligation	What is it?	Can a PET help? Yes/No/Partially	Expertise
Proportionality	The processing is proportionate in relation to the intended goals and is done in the least privacy intrusive way.	Yes, classic processing operations that are needed to achieve legitimate goals may seem disproportionate. PETs in general can help solve these problems.	Technical + legal
Lawfulness	One of the main principles of the GDPR is that the processing is lawful (article 5 GDPR). In order to assess if the processing is lawful, one of the legal ground for processing personal data (article 6 GDPR) should apply	No, neither suggested PET will create a legal ground such as consent, legal obligation or the performance of a task of public interest.	Legal
Fairness	One of the main principles of the GDPR is that the processing is fair (article 5(1)(a) GDPR)	Partially, MPC and Federated Learning can be used to restrict use and technically prevent data is used unintentionally for purposes that negatively impact an individual, which is an important part of fair processing.	Technical + legal + security
Transparency	Inform people how personal data is collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. (article 5(1)(a) GDPR, but also 12-14 GDPR).	No, the suggested PETs do not in itself enhance compliance with GDPR or give people control over the data.	Technical + legal + security
Purpose limitation	Personal data collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes	Partially/Yes, MPC and Federated Learning can be used to restrict use and prevent data is used unintentionally for purposes out of scope i.e. business rules of the MPC. Trusted secure environment can help to limit the amount of data to be processed specifically for the intended purposes. Note that results from a PET analysis are not controlled by PETs (anymore) and can in principle be used for other (unintended) purposes. For each newly considered purpose, a new legal assessment needs to be done.	Technical + legal + security
Data minimisation	Processing personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.	Yes, MPC, Federated Learning and trusted secure environment can allow you to precisely identify the data to be used for the intended outcome.	Technical + legal + security
Accuracy	Personal data is processed accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.	Yes, MPC allows you to develop specific business rules to double check the algorithmic calculations. No, DP in general will (intentionally) result in less accurate outcomes when processing personal data in order to safeguard output privacy.	Technical + legal + security
Storage limitation	Personal data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.	Partially. PETs do not directly contribute to storage limitation, however, often PETs offer the opportunity to not copy personal data but to process the data in memory. This results in no or very short storage periods, other than archiving purposes. Features such as automated deletion are not result of using PETs and can also be implemented with non-PET AI or other algorithms.	Technical + legal + security
Integrity and Confidentiality	Personal dataprocessed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.	Partially, all PETs contribute very strongly to confidentiality. FL and MPC keeps data confidential without leaving the premises.Trusted secure environment keeps data confidential and integer while leaving the premises. Differential privacy makes it possible to make analysis on data sets while withholding information about the individuals in the dataset. Integrity is only slightly improved with MPC and FL, since no data needs to be copied to another trusted third party, which results in new integrity risks.	Technical + legal + security
Accountability	The controller shall be responsible for, and be able to demonstrate compliance with, the data protection principles.	Yes, using PETs will make it possible to proof compliance with the GDPR data protection principles, most importantly confidentiality. Often when using PETs, there are joint controllers with different responsibilities, instead of one controller with all responsibilities.	Technical + legal + security
Data Protection by Design and Default (DPbDD)	Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement dataprotection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.	Partially, PETs can be employed as a measure in accordance with the DPbDD requirements if appropriate in a risk based approach. PETs in themselves do not necessarily cover the GDPR compliance as a whole or DPbDD entirely.	Technical + legal + security
International transfer (outside EEA)	Transfer of (meta) data from one country to another for research purposes.	Partially. MPC, HE and FL keep data confidential, but the encrypted or aggregated data being shared in these PETs can still be considered personal data in some cases. In case of an international transfer to a country outside the EEA faces challenges regarding the continuity of the same level of data protection, the PETS might help as supplementary measures to overcome these challenges.	Legal + Security

PET Questionnaire

1What is the type of problem?

Set intersection

2Can the identifiers be shared between the parties?

No

Yes