Authorities learn with NICPET to seize opportunities of secure data sharing

First pilot project shows potential value of PETs

That Privacy Enhancing Technologies (PETs) are secure as well as offering great potential for public authorities was recently demonstrated in a pilot project involving the Social Insurance Bank (SVB) and the Employee Insurance Agency (UWV).

One technology, Multi-Party Computation, was used to find out quickly and cost-effectively who might be entitled to the Supplementary Income Provision for the Elderly (AIO) but was not yet taking advantage of it.

This extra income can make a great difference to the living standards of the elderly. The trial was a success and demonstrates the potential value of PETs for targeted poverty reduction. But this is only the beginning.

Freek Bomhof, senior consultant in Data Science at TNO, sees a much wider scope. ‘In fact, Privacy-Enhancing Technologies prove their added value in all areas where public authorities and implementing authorities deal with sensitive personal data

It has now been amply proven that the technique can be used completely safely. However, I notice that public authorities are very reluctant, for fear of mistakes or scandals, although Privacy Enhancing Technologies are available precisely to help with this. After all, a better government is also one that makes better use of the data that’s available.’

NICPET created to develop knowledge on secure data sharing

A National Innovation Centre for Privacy-Enhancing Technologies (NICPET) has been created to better exploit these data-sharing opportunities. Ron Hanoeman, Innovation Adviser at the Ministry of Justice and Security (Innovation, Knowledge and Strategy Directorate), has been involved in the National Innovation Centre from the outset.

‘NICPET was created gradually, partly in response to a number of unpleasant events in the past, which might not have happened if there had been better information sharing between organisations.

How can we deploy PETs in such a way that we substantially and simultaneously take data use and data protection to the next level? That’s how we started, together with TNO as a knowledge partner of the Ministry of Justice and Security. Over time, ever more ministries and agencies have joined, enabling us to make a real impact on society.

The great thing about TNO is that they not only talk to us, but also to all these other agencies, so you find out that people elsewhere have the same questions. Let’s build knowledge and experience together that we can use more widely. I’d venture to say that if we hadn’t involved TNO, we wouldn’t have got to where we are today.’

More than just technology

Freek Bomhof knows that one of the trickiest issues in PET has turned out to be organising collaboration. ‘Of course, it nearly always concerns really sensitive data, where you have to address multiple dimensions together: technical, ethical, and legal dilemmas, which are intertwined.

Then there are practical obstacles, such as different IT systems. We noticed that a lot of these kinds of questions came up again and again, and that people were inspired by the answers and examples from other ministries and organisations.

‘How did you set up such a data protection impact assessment; can I take a look at it?’ Isn’t it useful to share best practices with each other? Are there questions we all have about PET that we can put to the scientists? The answer to all these questions was “yes”.’

That exchange of experiences and pooling of knowledge is proving to be an important added value of NICPET for all partners, as is developing inspiring new uses cases that can serve as examples for others.

Ron Hanoeman explains: ‘NICPET is particularly valuable because of the way we interact with each other: as friends of NICPET. Through the exchange of ideas, new applications emerge among parties.

The SVB case is a great example because it shows how to use available data in a GDPR-proof way to help society move forward. We’ve also developed several good use cases within the Ministry of Justice and Security. One is to find offenders who have yet to serve a sentence.

We use multiple data sources to analyse where the chances of catching someone are highest and how to use our scarce investigative capacity most efficiently to that end. With a use case on access requests, we want to improve services to citizens.’

‘Business in trouble’ pilot project with the Chamber of Commerce

Another great application comes from the Netherlands Chamber of Commerce. Saïd Akdim is Project Manager of the Innovation Lab there and he has also been involved in NICPET from the start.

‘For data collaboration, you need other interesting parties and you meet them in NICPET. The Chamber of Commerce wants to be a data-driven organisation. We have our Trade Register, and if we add data from other organisations, we may be able to serve entrepreneurs and private individuals even better.

I want to stress explicitly that privacy is always fully guaranteed. You see trends, but only anonymised and not at the level of the entrepreneur. In that way, you can, however, target your approach by region or sector.’

There was an interesting application during the Covid-19 pandemic. Akdim explains: ‘We had already introduced the ‘Business in trouble’ programme before the pandemic, to assist entrepreneurs with financial problems. With early signals and indicators, we could provide help much sooner and more effectively. But that requires data.

We know the entrepreneurs who call for help, but other agencies also have valuable information. By looking at debt accumulation, for example, you could spot early which groups of entrepreneurs are struggling in which regions.

Again, this is always with the guarantee of complete privacy. If you then proactively approach groups of entrepreneurs in certain regions or sectors to offer help, you have much more potential to avert bankruptcies, which ultimately means lower costs for society.

So far, there has been a trial based on fake data, and the next step is a pilot project with real data. With this trial, we mainly wanted to show how you set up such data collaboration, how the communication works, to really make it very practical.’

A mission to raise awareness of opportunities

According to Freek Bomhof, awareness of the opportunities offered by PET is now growing within the Dutch government. However, NICPET still has some missionary work to do.

‘Innovation managers are becoming enthusiastic and see the usefulness of this technology, so I do see a turnaround. Even in organisations that do not yet work with it, but can imagine using it. They still need to have some discussions internally, however, because not everyone automatically shares that enthusiasm. This makes sense, because it sounds paradoxical to bring data together without compromising privacy.’

Even among officials in the Ministry of Justice and Security, Ron Hanoeman sees increased interest and a need at all levels to focus on both data use and data protection.

‘For example, it was recently decided to set up a data sharing task force within the Ministry. PETs are also going to play a more important role in our privacy guidelines as a form of “privacy by design”.’ According to Bomhof, this is a good development, as the need to adopt this technology continues to grow.

‘Recently, the Court of Audit sent an important letter to the House of Representatives, expressing concern that organisations are becoming more cautious out of fear of the GDPR, sometimes using the GDPR as an excuse for avoiding sharing information with other government parties.

We’re really selling ourselves short as a country if we don’t seize the opportunities of secure data sharing for fear of data leaks or headlines.’

The aim? To become redundant

Bomhof is positive about the future prospects of NICPET. ‘Above all, I hope we can maintain the energy and enthusiasm, and pass it on to new participants. Expansion would therefore be good, including public-private data exchange, for example.’

NICPET partners could also jointly develop initiatives to promote the adoption of the technology. ‘Examples could be collectively drafting procurement specifications for PET software, or a white paper on the legal aspects of the various technologies.’

But that is not Bomhof’s greatest wish for the future of safe data sharing technologies: ‘Ultimately, I hope we’ll have made ourselves completely redundant in about five years’ time. Then we can say “mission accomplished”, and that we’ve left the Netherlands a little better. Because ultimately, you want information protection to be optimally applied everywhere, and for it to have become a normal way of working.’