5.4 Privacy-Enhancing Technologies & Technical Control Enforcement
Key Takeaways
- IV.C's privacy technologist collaboration duty means the privacy manager scopes the use case, identifies candidate PETs, engages technologists to evaluate feasibility, verifies outcomes, and documents decisions — the privacy manager does not implement cryptographic protocols
- Pseudonymization replaces direct identifiers with reversible tokens and remains personal data under GDPR; tokenization uses a vault mapping and reduces PCI scope but makes the vault a high-value target; neither is anonymization
- Differential privacy adds calibrated noise governed by a privacy budget (epsilon) that trades off privacy vs. utility — repeated queries deplete the budget, a key limitation the exam tests
- Federated learning trains models on-device so only model updates are centralized, not raw data — but model updates can still leak information about individual training data without additional protections
- True anonymization requires that re-identification be reasonably impossible by any means likely to be used; the privacy manager must not accept a vendor's anonymization claim without understanding the method and residual re-identification risk
The Privacy Manager's Role: Collaborate, Don't Implement
IV.C's privacy-technology performance indicator asks the privacy manager to collaborate with privacy technologists to enable technical controls for obfuscation, data minimization, security, and other privacy-enhancing technologies (PETs). The key word is collaborate. The CIPM does not expect the privacy manager to implement cryptographic protocols or train machine-learning models. It expects the privacy manager to:
- Scope the use case — what data, what purpose, what risk, what minimization is possible?
- Identify candidate PETs — which techniques could reduce risk for this use case?
- Engage technologists — work with engineering, security, and data science to evaluate feasibility and cost.
- Verify outcomes — confirm that the deployed PET reduces risk as intended and does not introduce new risks.
- Document decisions — record why a PET was chosen or rejected, for accountability and audit.
This collaboration model is itself an application of PbD Principle 3 (Privacy Embedded into Design) — the privacy manager brings privacy requirements into the technical design conversation, not after the system is built.
Key Privacy-Enhancing Technologies
PETs Capability Table
| Technique | What It Protects | Typical Use Case | Key Limitation |
|---|---|---|---|
| Pseudonymization | Replaces direct identifiers with reversible tokens; data remains re-identifiable with the key | Analytics on customer datasets where a trusted controller holds the re-identification key | Not anonymization; re-identification risk remains; GDPR still treats pseudonymized data as personal data |
| Tokenization | Replaces sensitive values (e.g., card numbers) with non-sensitive tokens mapped in a vault | Payment processing (PCI scope reduction), reducing exposure of full card numbers | The token vault itself becomes a high-value target; vault compromise re-exposes original values |
| Differential privacy | Adds calibrated noise to query results or datasets so individual records cannot be distinguished | Census statistics, aggregate analytics, public data releases | Privacy budget (epsilon) trades off privacy vs. data utility; repeated queries deplete the budget |
| Federated learning | Trains models on-device or at the data source; only model updates (gradients) are centralized, not raw data | Mobile keyboard prediction, on-device health inference without centralizing raw data | Model updates can leak information about individual training data; requires additional protections (e.g., secure aggregation) |
| Homomorphic encryption | Allows computation on encrypted data without decrypting it | Outsourced computation on sensitive data (e.g., medical analytics on encrypted health records) | High computational overhead; limited operations; not yet practical for all workloads |
| Secure Multi-Party Computation (SMPC) | Multiple parties jointly compute a function over their inputs without revealing those inputs to each other | Cross-organization analytics (e.g., two banks computing joint fraud scores without sharing customer records) | Communication overhead; requires multiple non-colluding parties; complex to implement |
| Data minimization techniques | Reduces data collected, retained, or exposed to the minimum necessary for the stated purpose | Field-level minimization in forms, short retention periods, aggregation, truncation | Can reduce analytical utility; must be balanced against the business purpose |
| On-device / edge processing | Processes data locally on the user's device; raw data never leaves the device | On-device voice recognition, on-device face matching | Limited compute and model size on device; harder to update; does not protect against device compromise |
| Anonymization | Irreversibly prevents re-identification of individuals by any means likely to be used | Public research datasets, open data releases | True anonymization is hard; re-identification risk from auxiliary data (quasi-identifiers, linkage attacks); GDPR's anonymization bar is high |
The Anonymization Trap
The exam frequently tests the distinction between anonymization and pseudonymization. Under GDPR (and most modern privacy frameworks), pseudonymized data is still personal data because it can be re-identified with the key. Only irreversibly anonymized data — where re-identification is reasonably impossible by any means likely to be used — falls outside the scope of privacy law. The privacy manager must not accept a vendor's claim that the data is anonymized without understanding the method, the residual re-identification risk, and whether auxiliary data could be used to re-identify individuals through linkage attacks.
Worked Scenario: Selecting PETs for a Health Analytics Project
A hospital wants to collaborate with a university research lab to study treatment outcomes across 50,000 patient records. The hospital cannot share raw patient data with the university due to HIPAA and ethical constraints. The privacy manager is asked to recommend a technical approach.
How does the privacy manager apply IV.C?
-
Scope the use case — the university needs to run statistical analyses on treatment outcomes; it does not need individual patient identities or the ability to re-contact patients.
-
Identify candidate PETs:
- De-identification (HIPAA Safe Harbor or Expert Determination) — removes 18 direct and quasi-identifiers. Useful, but the university must not be able to re-identify patients using auxiliary datasets.
- Differential privacy — adds noise to query results so no individual patient's record can be distinguished. Strong protection for aggregate statistics.
- Federated learning — if the university is training a predictive model, the model could train at the hospital and only gradients are shared.
- SMPC — if multiple hospitals collaborate, SMPC allows joint analysis without any hospital sharing raw data with the others.
-
Engage technologists — the privacy manager does not choose the cryptographic parameters or the epsilon value; the hospital's security team and the university's data scientists evaluate feasibility, computational cost, and utility trade-offs.
-
Verify outcomes — before the dataset or query interface is released, the privacy manager confirms that re-identification risk has been assessed (e.g., by a HIPAA Expert Determination or a differential-privacy epsilon budget) and that the university's access is logged and bounded.
-
Document decisions — record why de-identification plus differential privacy was chosen, what the residual risk is, and what controls (e.g., no linkage to external datasets) the university must follow.
The privacy manager's value is in framing the risk and the options, not in implementing the noise-injection algorithm. The collaboration with technologists is what IV.C expects.
A vendor tells a privacy manager that a customer dataset has been anonymized by replacing each customer's name with a random ID and storing the name-to-ID mapping in a separate lookup table that the vendor controls. Under GDPR and most modern privacy frameworks, what is the correct characterization of this dataset?
A hospital wants to collaborate with a university to run statistical analyses on 50,000 patient records without sharing raw patient data. The privacy manager's role under IV.C's PETs collaboration duty is best described as: