Examining Compliance with Personal Data Protection Regulations in Interorganizational Data Analysis

Szu-Chuang Li,Yennun Huang,Yi-Wen Chen

doi:10.3390/su132011459

Abstract

The development of big data analysis technologies has changed how organizations work. Tech giants, such as Google and Facebook, are well positioned because they possess not only big data sets but also the in-house capability to analyze them. For small and medium-sized enterprises (SMEs), which have limited resources, capacity, and a relatively small collection of data, the ability to conduct data analysis collaboratively is key. Personal data protection regulations have become stricter due to incidents of private data being leaked, making it more difficult for SMEs to perform interorganizational data analysis. This problem can be resolved by anonymizing the data such that reidentifying an individual is no longer a concern or by deploying technical procedures that enable interorganizational data analysis without the exchange of actual data, such as data deidentification, data synthesis, and federated learning. Herein, we compared the technical options and their compliance with personal data protection regulations from several countries and regions. Using the EU’s GDPR (General Data Protection Regulation) as the main point of reference, technical studies, legislative studies, related regulations, and government-sponsored reports from various countries and regions were also reviewed. Alignment of the technical description with the government regulations and guidelines revealed that the solutions are compliant with the personal data protection regulations. Current regulations require “reasonable” privacy preservation efforts from data controllers; potential attackers are not assumed to be experts with knowledge of the target data set. This means that relevant requirements can be fulfilled without considerably sacrificing data utility. However, the potential existence of an extremely knowledgeable adversary when the stakes of data leakage are high still needs to be considered carefully.

Highlights

IntroductionWith the rapid development of machine learning and deep learning, public and private organizations have increasingly leveraged big data technologies to, for example, uncover novel solutions or provide evidence for business decisions that are otherwise based on intuition, according to Harvard business review
When investigating the privacy concerns of federated learning, we often assume that the central server is a curious one, and privacy concerns may arise if we examine the problem from the perspective of differential privacy [39]
The requirement of a large amount of data and rich data attributes creates a tension between data processing and privacy when personal data are involved

Summary

Introduction

With the rapid development of machine learning and deep learning, public and private organizations have increasingly leveraged big data technologies to, for example, uncover novel solutions or provide evidence for business decisions that are otherwise based on intuition, according to Harvard business review. For small- and medium-sized enterprises (SMEs), big data presents significant opportunities and challenges. The benefit of using big data technology becomes more evident as the volume and variety of data increase [4]. For small businesses or organizations, independently achieving the four Vs of big data, namely velocity, volume, variety, and veracity [5], is challenging. The substantial technological capacity, number of users, and variety of services of tech giants such as Google and Facebook better equip these enterprises to attain these goals

Objectives

Findings

Discussion

Conclusion