Integrating Technical and Legal Concepts of Privacy

Abstract

We provide an overview of legal and technical concepts of privacy protection. Data protection guarantees exist in European Union at a primary law level since 2009, when the Lisbon Treaty has become effective. The new regulation called general data protection regulation adopted on April 27, 2016 will enter into effect on May 25, 2018. Regarding data protection, the US follows a very different approach. The cornerstone of the technical framework of data protection is the concept of differential privacy for which the privacy’s provable guarantees hold even against worst-case scenarios when the access to arbitrary auxiliary information is provided. Research directions for integrating legal and technical concepts of privacy are discussed. Although both fields, legal and technical, approach privacy from different perspectives, we expect that these approaches will converge to a common framework. The privacy-preserving framework, therefore, should be a balance between: 1) ambiguous legal concepts and precise mathematical notions of privacy; 2) the desired privacy level; 3) the information loss, which is measured by data utility metrics; and 4) the complexity and the practical feasibility of the proposed technique. Key notions of fairness are incompatible with each other, and hence any privacy-preserving framework should also include the trade-offs between conditions imposed in the definitions of fairness. The complex assembly of legal and technical components implementing various privacy requirements in the privacy-preserving framework, should be realized within the privacy-by-design concept.