Search papers, labs, and topics across Lattice.
This paper addresses the emerging privacy risks associated with the distributed processing of personal data by multiple service providers, highlighting how compositional risks can lead to unintended linkability of data. The authors propose a novel protocol designed to detect and manage these risks, which are often overlooked in traditional data protection impact assessments. Key findings demonstrate that their protocol enhances the effectiveness of risk assessments by identifying candidates for compositional risks, thereby improving data privacy outcomes in complex service compositions.
Compositional risks in data processing can lead to overlooked privacy vulnerabilities, but a new protocol effectively identifies and mitigates these threats.
When personal data is processed in a distributed manner by cooperating service providers, privacy risks may emerge solely from the choice of data processors included in the composition. For instance, different data processors may unknowingly rely on the same cloud provider, allowing for unintended linkability of personal data at that very provider. As such compositional risks to privacy are beyond the scope of each individual risk assessment, they are likely to be overseen when performing a data protection impact assessment. In this paper, we propose a novel protocol to detect and manage such compositional risks to privacy. Following an initial problem definition and requirements elicitation, we elaborate how our protocol identifies candidates for compositional risks and how this information may be used to improve the results of a data protection impact assessment over service compositions including multiple data processors.
