Privacy Enhancing Technologies (PETs) are tools that help organisations derive insights from personal data in a secure way. They do this without exposing personal information, while ensuring data security. PETs typically do this through two key approaches: (1) enabling collaboration without sharing original data, using technologies such as Federated Learning and Trusted Execution Environments; and, (2) enabling safer data sharing by protecting or transforming the data so that insights can be accessed without exposing the original dataset, leveraging technologies such as Synthetic Data Generation.

New Federated Learning Guide

At the inaugural Singapore Data Festival this year, PDPC launched a Guide on Federated Learning to help organisations understand and adopt Federated Learning.

AI training and development requires centralising data, but valuable data for AI development is often siloed, sensitive, or regulated, making it difficult to access and share. Federated Learning offers a way to develop AI models by extracting the relevant data and insights.

Through the Guide, businesses can expect to understand what Federated Learning is and how it can be used and adopted through case studies. The Guide also includes an adoption roadmap which helps businesses assess whether Federated Learning is suitable for their business needs, understand what is needed to adopt Federated Learning and how to design and configure a suitable Federated Learning solution. Recommendations for risk management are also provided within the Guide.

Revised Synthetic Data Guide

PDPC has also updated the Guide on Synthetic Data Generation (SDG) with the latest industry research to advise organisations on the creation of artificial datasets. Unlike Federated Learning which enables collaboration whilst keeping data stored locally, SDG creates artificial datasets that mirror the statistical properties of real data without containing personal information of individuals. The updated guide expands on new generation methods and best practices to produce synthetic data and prevent re-identification. It also includes new case studies on organisations that have successfully generated synthetic data for practical applications.

The Federated Learning and SDG Guides help businesses assess which PET is suitable, adopt stronger safeguards, and unlock data for innovation, collaboration and AI development in a more privacy-preserving way. The Guides are available on PDPC’s website and complement IMDA’s PET Sandbox, which provides a safe environment for organisations to explore PETs.

IMDA’s PET Sandbox New Use Cases

IMDA’s PET Sandbox has seen wide industry participation and has facilitated numerous real-world use cases. To date, 11 organisations from sectors such as finance, healthcare, construction, transport, and advertising tech have successfully implemented PETs within the Sandbox, with more expected to join in the pipeline. To further encourage the adoption of PETs, IMDA is enhancing the PET Sandbox with new practical resources, which will allow organisations to explore and experience PETs through demonstrations of various PET tools before they test and implement their own use case within the Sandbox.

New Use Case – Singapore General Hospital

Singapore General Hospital (SGH) joined IMDA’s PET Sandbox to evaluate the cost-effectiveness and security of leveraging cloud resources for data storage and computation of medical images.

Medical images play an important role in helping doctors diagnose and treat patients. AI can help analyse these images more quickly and accurately, allowing healthcare professionals to make better-informed decisions. As AI requires significant computing power, cloud computing provides the necessary flexibility and scalability. However, storing these images on the cloud makes it essential for hospitals to exercise heightened caution to safeguard patients’ personal and medical data.

In this use case, SGH leveraged a Trusted Execution Environment (TEE) solution by A*STAR Institute of Advanced Intelligence and Computing (A*STAR IAIC) to explore if medical images can be analysed securely in the cloud. TEE is a secure, isolated, hardware-based environment that keeps sensitive data protected while it is being processed. Medical images were first digitised and uploaded to the secured cloud environment, where AI analysed them. The results were then used to support doctors in making clinical diagnosis.

By combining the computing power of cloud with the security of TEE, healthcare providers can process more medical images in a shorter time while keeping sensitive patient data protected. This could help hospitals meet growing demand for AI-assisted diagnosis, without compromising the privacy of the patients’ medical information. Details of SGH’s use case can be found on IMDA’s website.

New Use Case – Ant International

Ant International joined IMDA’s PET Sandbox to understand how PETs could help to preserve the privacy of ecosystem partners, e.g. acquirers, merchants and payment systems when processing payment requests and conducting risk controls.

Ant International works closely with partners such as merchants, acquirers, and wallet partners to collect, store and process data for payment requests and marketing discounts to satisfy business rules. It wanted to enhance Alipay+ (Ant International’s payment infrastructure) by using Multi-Party Computing (MPC) to verify transactions so as to minimise the collection and storage of personal data.

MPC allows multiple participants to work together to solve a computational problem using their private inputs, without revealing those inputs with one another. Only the authorised party can view the final result, ensuring strict confidentiality during the collaborative data process. With MPC, sensitive data from the collaborating merchant and wallet partners does not need to be collected or stored, while the authorised party can still perform risk controls without assessing sensitive data.

With the use of multi-party computing, Ant International is able to evaluate risk control checks for payment requests and marketing discount eligibility checks, whilst reducing the collection and storing of potentially sensitive data, reducing privacy risks. Details of Ant International’s use case can be found on IMDA’s website.