Data Privacy

Defining Data Privacy

Before we delve into the world of data privacy, let us begin by defining what it is. The US National Institute for Standards and Technology (NIST) defines privacy as “assurance that the confidentiality of, and access to, certain information about an entity is protected.” From that, we can extrapolate data (or Information) privacy to be defined as “the assurance that the confidentiality of, and access to, certain data (information) regarding an entity (person, object, project, etc.) is protected.”

When we apply data privacy in the context of a person, it would mean the extent and assurance that a person’s sensitive personal information (identification number, contact information, health, and financial records etc.) is safeguarded and shared in accordance with the permissions set by regulating bodies.

Data privacy empowers individuals with control over how their data is collected, processed, and shared. This protection is crucial to maintaining the trust of individuals and upholding ethical standards in the handling of data across various sectors and industries.

Why is Data Privacy so important?

With the growing wealth of data collected and fused by organisations in both the public and private sector, it is increasingly important to safeguard sensitive personal information from unauthorised access, as well as mitigate against the risk of identity theft, fraud, and other malicious activities. As societal awareness and norms regarding privacy concerns continue to evolve, data privacy allows the individuals to decide how their personal data is collected and used, while ensuring that personal information is not misused without the explicit consent of said individuals.

Data privacy is also important for maintaining a strong trust relationship between the individual and the authoritative bodies responsible for safeguarding their data. In the case of the public sector, data privacy becomes paramount for ensuring a strong trust relationship and confidence between the various government entities and citizens.

Additionally, a data breach may lead to undesired outcomes both for organisations and individuals. For an organisation, data breaches could potentially harm their reputation and result in legal sanctions and fines. This could also reduce the confidence and trust that customers and stakeholders have in the organisation. For affected individuals, data breaches may result in personal information being used by malicious entities without their knowledge, which in worst cases could result in identity theft and financial fraud.

Data Privacy and Data Security

Data pivacy and security are closely intertwined. Privacy cannot exist without security, since any breach of security measures can lead to unauthorised access and potentially cause privacy harms. Thus, it is essential to understand this close relationship as opposed to considering these two concepts in isolation.

Data privacy entails the protection and responsible use of sensitive data, giving individuals control over their personal information and ensuring that it is handled appropriately by authorised parties. Techniques like data classification, inventorying, and secure deletion contribute to safeguarding privacy. Moreover, privacy-preserving technologies such as anonymisation, differential privacy, and homomorphic encryption help protect sensitive data from unnecessary exposure.

Data security, on the other hand, focuses on safeguarding data from unauthorised access, modifications, or exfiltration by external malicious actors. This involves implementing various measures such as encryption, role-based access controls, and identity access management (IAM) to maintain data confidentiality, integrity, and availability.

It is worth noting that privacy goes beyond security by also addressing internal misuse of data. Organisations must be vigilant in preventing potential misuse of data by employees or insiders who have legitimate access to sensitive information. For instance, consider a scenario where a company’s security measures successfully fend off a cyber attack, preventing external hackers from accessing customer data.

However, an internal employee with malicious intent misuses the same data, causing a significant privacy breach. To prevent such situations from happening, organisations need to implement comprehensive data privacy and security practices, ensuring protection against both external threats and internal misuse.

By combining data privacy and data security practices, organisations can adopt a more comprehensive and holistic approach to safeguarding sensitive data, fostering trust with customers and stakeholders alike.

Data Privacy and Privacy-Enhancing Technologies

The use of sensitive data and personal information by government agencies, research organisations, and enterprises has grown substantially due to advancements in analytical techniques like machine learning. While this has propelled innovation, scientific research, and the enhancement of public policies through big data analysis, the increasing collection and utilisation of personal information has also resulted in evolving risks of private information disclosure and inference that threaten individual privacy protection. In addition, the widespread adoption of large language models (LLMs) and the necessity to train them on potentially sensitive data further compounds these privacy concerns.

To gain access to sensitive data while guaranteeing privacy preservation, Privacy Enhancing technologies (PETs) have garnered increased attention. PETs encompass a collection of digital technologies and approaches that enable the collection, processing, analysis, and sharing of information while safeguarding the confidentiality of sensitive data. By effectively integrating PETs as part of data processing pipelines and workflows, organisations can not only strike a balance between data utilisation and privacy but also foster trust in data-driven environments.

Democratising PETs - featuring Cloak

To facilitate the wider adoption of any technology, it is crucial to first establish a robust infrastructure that provides effective solutions for a diverse range of use cases. This principle holds true for data privacy, which lacks a one-size-fits-all solution and requires practical approaches to address specific privacy challenges. In line with this, the Data Privacy Protection Capability Center (DPPCC) at GovTech has developed Singapore’s first whole-of-government Central Privacy-Preserving Toolkit (”Cloak”), which has been adopted by over 80 government agencies. This toolkit serves as a user friendly, self-service portal that simplifies and democratises PETs for non-technical users. By continually enhancing its capabilities, including the integration of advanced technologies like differential privacy and synthetic data generation, Cloak empowers the public sector to seamlessly incorporate robust data privacy measures into their operations, promoting a culture of privacy-consciousness throughout the government and driving wider adoption of PETs.

Furthermore, as part of our ongoing outreach to the data privacy community, the DPPCC team has released a four-part article series and open-source code focusing on an emerging PET: differential privacy. Differential privacy offers provable privacy guarantees while enabling meaningful data analysis through the controlled addition of noise to datasets. The series includes:

Part 1: Sharing Data with Differential Privacy: A Primer – A beginner’s guide to understanding the fundamental concepts of differential privacy with simplified mathematical interpretation.

Part 2: Practitioners’ Guide to Accessing Emerging Differential Privacy Tools — Explore the emerging differential privacy tools developed by prominent researchers and institutions, with practical guidance on their adoption for real-world use cases.

Part 3: Evaluating Differential Privacy Tools’ Performance — A comparative analysis of the accuracy and execution time of differential privacy tools in both standalone and distributed environments, with a focus on common analytical queries.

Part 4: Getting Started with Scalable Differential Privacy Tools on the Cloud — A step-by step guide to deploying differential privacy tools in a distributed environment on AWS services, specifically AWS Glue and Amazon EMR, to support the analysis of large datasets.

As the frontier of data privacy continues to expand rapidly, collaborations among industry, government, nonprofit organisations, and academics will be helpful in the success of responsible data sharing.

Visit the Singapore Government Developer Portal to find out more about GovTech’s Central Privacy Toolkit.