By Alexandra Kelley, Staff Correspondent

Absent comprehensive federal law, the strategy represents a new chapter toward regulating data privacy protocols for US online users.

The White House released comprehensive new recommendations to promote user data privacy for both public and private sector entities, focusing on mitigating bias and maximizing efficiency in an equitable way.

Released by the Office of Science and Technology Policy late Thursday, the “National Strategy to Advance Privacy-Preserving Data Sharing and Analytics” formalized the administration’s goals to support the research, development, regulation and application of solutions to the ethical and sociotechnical issues with data collection and analysis—known as privacy-preserving data sharing and analytics, or PPDSA, technologies—while focusing on use cases that do not violate user confidentiality.

“PPDSA technologies have enormous potential, but their benefit is tied to how they are developed and used,” the report begins. “Consideration of how individuals may control the collection, linking and use of their data should also factor into the design and use of PPDSA technologies.”

The strategy establishes four guiding pillars that represent the foundation of its approach to privacy and data:  crafting PPDSA technologies that protect civil rights, promoting innovation alongside equity, building technologies with accountability mechanisms and minimizing exposure of vulnerable groups.

The recommendations chronicled in the OSTP’s new report advocate for continued development of data analytics technologies, but with a sociotechnical approach that characterizes current federal guidance on emerging tech.

“Public trust will hinge on the justified assurance that government, academic and industry use of PPDSA solutions will respect privacy, civil liberties and civil rights. The future PPDSA ecosystem must be transparent and inclusive and reflect privacy principles and preferences,” the strategy states.

It also advocates competing organizations developing data analytics systems to share and process data in a way that does not violate user privacy and rights. Safely sharing sensitive data will demand approaches that include securing and copying the original dataset for dissemination, using attribute-based encryption and restricting access to shared data.

The strategy emphasizes that these protocols be incorporated into the technology during the development stage.

“Embedding the design, development and deployment of PPDSA technologies in a larger framework that encompasses legal, regulatory, ethical and policy mechanisms will help to create this level of accountability,” the report reads.

Part of the sociotechnical approach calls for increased research funding to examine more sophisticated use cases. Incorporating complex datasets to better produce analytics for emerging issues like smart city sustainability, social network metrics and personalized medicine development are scenarios OSTP is envisioning alongside robust privacy capabilities.

The strategy lays out 16 recommendations across five strategic priorities to advance PPDSA technologies:

• Establish a steering group to support PPDSA guiding principles and strategic priorities.
• Clarify the use of PPDSA technologies within the statutory and regulatory environments.
• Develop capabilities and procedures to mitigate privacy incidents.
• Develop a holistic scientific understanding of privacy threats, attacks and harms.
• Invest in foundational and use-inspired R&D for PPDSA technologies.
• Expand and promote interdisciplinary R&D at the intersection of science, technology, policy and law.
• Promote applied and translational research and systems development.
• Pilot implementation activities within the federal government.
• Establish technical standards for PPDSA technologies.
• Accelerate efforts to develop standardized taxonomies, tool repositories, measurement methods, benchmarking and testbeds.
• Improve usability and inclusiveness of PPDSA solutions.
• Expand institutional expertise in PPDSA technologies.
• Educate and train participants on the appropriate use and deployment of PPDSA technologies.
• Expand privacy curricula in academia.
• Foster bilateral and multilateral engagements related to a PPDSA ecosystem.
• Explore the role of PPDSA technologies to enable cross-border collaboration.

Other technical approaches the strategy calls for within PPDSA system design are secure multiparty computation, where many parties can perform analysis of private data “while allowing each party to learn only the final computational output;” synthetic data usage for training purposes; K-anonymity, which transforms datasets so that record of a particular individual is “indistinguishable from the others;” and zero-knowledge proofs, which allow one party to prove the validity of a statement without revealing sensitive information.

Scalability and cost factors were common challenges listed for more mature and secure PPDSA technologies. Unraveling these issues will require increased investments in research to advance secure approaches to data architecture.

“Substantial and sustained investment in both the public and private sectors should support accelerated R&D that is focused on emerging PPDSA technologies and bold exploratory research targeted to create the next generation of PPDSA capabilities,” the strategy states.