Safe data use: Striking a balance between insight and privacy

As companies begin to look toward the future of their businesses, data has become one of the most valuable assets. It is powering not just the strategies and decisions of existing companies but also the emergence of entirely new economies and markets that had not previously existed.

More companies are starting to take advantage of data-driven insights in order to get a leg up on the competition. An April 2019 survey by Deloitte highlighted the fact that companies with strong analytics cultures “significantly exceeded their business goals in the past 12 months.” This is because in using data, companies are gaining good information to enrich their products and services. This further reinforced a 2017 Aberdeen survey, which noted that companies leveraging on data to drive strategy and development see a marked 45% decrease in time spent bringing a product to market.

Data and privacy take center stage

Unfortunately, the prevalence of data is also creating privacy problems as legislation to govern its responsible use can’t keep up with the amount of data generated. This has led to a rise in major data breaches, such as the infamous 2017 Equifax scandal, which resulted in the exposure of 147.9 million consumers’ credit information.

Companies are now more aware of privacy issues and are responding to breaches with cybersecurity measures, but cyber vulnerability remains a threat. According to Noam Dror, vice president of worldwide privacy engineering at data privacy firm Privitar, a significant area of exposure for companies is the growing number of partnerships with third parties such as mobile marketing or CRM solutions providers. These outside consultants provide valuable support to businesses but they are also potential “backdoors” that expose companies indirectly.

Noam Dror, vice president of worldwide privacy engineering at Privitar / Photo credit: Privitar

Accenture’s State of Cyber Resilience Report 2020 points out that hackers and malicious actors are taking increasingly sophisticated angles of attack: 40% of cyberattacks have shifted downstream to the aforementioned third parties.

This was the case with one of the largest data breaches of 2019. Game developer Zynga, which put out games playable on and integrated with Facebook, was hacked last year, leading to the leakage of 170 million users’ passwords. Hackers didn’t need to go after Facebook itself; instead, they exploited the vulnerabilities of the platform’s ecosystem.

“There’s no absolute security”

As our daily lives become increasingly oriented around digital services and social media platforms, it’s also becoming increasingly clear how impossible it is to totally eliminate all privacy and security risks. “There’s no absolute security,” confirms Privitar’s Dror. “We [can] put locks on all our houses, but we’ll still get break-ins.” Today’s digital natives need to give up on the idea of absolute security and instead embrace data-centric techniques that assume a zero-trust environment.

He provides an example of privacy risk: combining publicly available Covid-19 data with easily accessible social media information to re-identify infected individuals. The combined data creates a “linkage attack” situation where multiple sources of information are combined to “re-identify” otherwise anonymized data. The repercussions of such an incident could not only endanger the exposed individuals but also pose serious legal liabilities to the firms handling the data.

Additionally, there is a cooling effect such cases have on the willingness of companies to pursue technological breakthroughs. Innovation happens when disparate pieces of data are brought together to form new insights. But if companies are wary of inadvertently breaking the law, they could start backing off from these innovative ideas, perhaps even abandoning them altogether.

“It stops everyone from going down the path of doing innovative work,” Dror says.

A vision for the future of data privacy

According to Dror, the problem isn’t necessarily the amount of personal data floating around, but rather how visible the data makes individuals. Privitar’s Data Privacy Platform aims to reduce, as much as possible, the potential for datasets to be used to re-identify people.

One such tool in the platform’s arsenal automatically adjusts the “resolution” of the data. For instance, in the issue of Covid-19 patient information, the data included specific details such as age, gender, area of residence, and workplace. By replacing these data points with more generalized information, it’s become harder for data to be used for re-identification.

Another method is the application of “watermarks” in specific datasets for specific use cases. Watermarks containing recipient and use case information are embedded within the datasets and are traceable across thumb drives, emails, and formats.

The watermarks provide “proof that this data belongs to you,” says Dror. “This will control the behavior of people [and make them] respect the use of data and make sure it’s safe.”

Photo credit: Privitar

This particular technique was especially relevant for one of Privitar’s major clients, National Health Service Digital. The national information and technology partner to the United Kingdom’s health and social care system wanted to take advantage of its large volume of patient data to provide better medical services by working with third parties with machine learning and analytics technologies. However, regulators flagged major privacy breach issues with this open sharing of patient information.

NHS Digital engaged Privitar’s services to create a centralized solution to de-identify patient records, and watermarks embedded in datasets make them safe to disseminate to trusted third party research environments.

The digital privacy industry is seeing its relevance grow as the volume of highly sensitive data rises. The coronavirus pandemic has made healthcare information more crucial and more exposed than before. Healthcare-related data breaches are on the rise as cybercriminals take advantage of the situation to exploit privacy vulnerabilities.

Dror noted that companies are also accelerating their digital transformation, which raises the need for more robust data collection and management services. “We have customers coming to us asking for more help as they have more highly sensitive data to incorporate,” he says.

Shaping the future of data privacy

The coronavirus pandemic has helped data privacy firms by centering the conversation around how companies must rise to meet the challenges posed by a data-driven digital future. “Data and privacy are going to become increasingly mainstream ideas,” says Dror. “Companies need to demonstrate to the market that privacy is going to be mainstream. We see it as the new norm for large organizations to take this seriously.”

Companies will have to walk a fine line between balancing security concerns and optimizing the benefits of data in order to find solutions to difficult questions that have few straight answers. There are exciting debates taking place across the industry about the state of our private lives amidst a digital reality, and the outcomes will become particularly significant to both organizations and individuals in the near future.

For more information about data management and protection, please visit Privitar’s website.

This content was produced by Tech in Asia Studios, which connects brands with Asia’s tech community. Learn more about partnering with Tech in Asia Studios.