by Teodor Ionut Matei (Siemens)

As healthcare becomes increasingly digital, sharing health information between institutions can unlock important benefits, such as more coordinated services to better analysis, planning and research. At the same time, health records contain some of the most sensitive personal information. The challenge is therefore not simply how to transfer data, but how to ensure that data remains protected throughout the process.

Within the CONSENTIS framework, Privacy Enhancing Technologies (PETs) provide an additional technical layer of protection between data controllers and authorised parties. Rather than relying exclusively on access controls and consent mechanisms, the PET layer ensures that data are privacy protected before they leave the controlled environment of the data provider.

This approach reflects the principle of data protection by design and by default established by the GDPR, which calls for appropriate technical and organisational safeguards to be integrated into data processing activities. Encryption and pseudonymisation are explicitly recognised among the measures that may contribute to appropriate security. [1]

Privacy protection starts before the data leaves the source

The CONSENTIS PET layer is positioned close to the data provider side of the architecture. Its role is to receive the data authorised for disclosure, determine which privacy preserving measures are appropriate for the request, apply those measures, and prepare the resulting output for secure transfer.

This is important because not every data sharing scenario has the same privacy requirements.

For example, transferring the health record of one specific individual is fundamentally different from providing a dataset containing thousands of records for statistical analysis. CONSENTIS therefore uses a modular PET pipeline, allowing different privacy technologies to be activated according to the characteristics and purpose of each authorised request.

Three key technologies form this layer: generalisation and anonymisation, differential privacy, and encryption.

Anonymisation: reducing the risk of re-identification

For multi-record datasets, the generalisation module applies techniques including k-anonymity, l-diversity and t-closeness. These techniques can generalise or suppress identifiers and quasi-identifiers, making it more difficult to associate records with specific individuals while retaining useful information for an authorised analytical purpose.

This is particularly relevant for scenarios where multiple records may be requested for activities such as cost analysis or statistical modeling.

Importantly, anonymisation is not treated as a universal solution. Its suitability depends on the dataset, the context and the intended use. This is why the PET layer selects privacy measures according to the disclosure scenario rather than applying one technique indiscriminately. European cybersecurity and data protection guidance similarly emphasises that PETs need to be selected and engineered according to the specific processing context. [2]

Differential privacy: protecting against inference

Anonymisation can be complemented by differential privacy, a mathematical approach designed to limit what can be inferred about an individual from the output of a data analysis.

Rather than simply removing identifying information, differential privacy introduces carefully calibrated randomness into analytical outputs. The strength of this protection can be controlled through a privacy budget, which represents an upper bound on cumulative privacy loss across analyses performed on a dataset. [3]

In CONSENTIS, an important additional feature is the automatic trigger mechanism that determines an appropriate privacy budget based on characteristics of the dataset. This supports a more context sensitive approach: the amount of protection can be adapted to the characteristics of the requested data and analysis rather than relying on a fixed configuration for every situation.

Encryption: protecting data in transit

For individual level transfers, statistical anonymisation techniques are not appropriate because the request concerns a specific person’s record.

Here, the PET strategy focuses on protecting the confidentiality of the record during transmission. The selected health record is encrypted on the provider side using the authorised party’s public key. The encrypted record is then transferred, and only the intended recipient can decrypt it using the corresponding private key.

In this way, encryption protects the original content without changing its meaning or usefulness for the authorised processing activity. It provides a different type of protection from anonymisation and differential privacy: rather than reducing what can be learned from the data, it protects the data while it is are being transferred.

Layered protection for different needs

The strength of the CONSENTIS approach lies in combining these technologies rather than treating PETs as a single mechanism.

The result is a layered approach in which consent and authorisation determine whether a disclosure is permitted, while PETs help determine how the authorised data can be safely prepared for disclosure. This reflects the broader use of privacy enhancing approaches to enable personal data sharing while reducing associated privacy risks. [4]

Ultimately, the goal is not to prevent legitimate data sharing. It is to make that sharing more privacy aware by design: keeping raw health records within the provider’s controlled environment wherever possible, releasing only what is authorised and necessary, and applying appropriate technical protection before information crosses institutional boundaries.

In a digital healthcare ecosystem, privacy is not simply a matter of controlling who can access data. It is also about controlling what is disclosed, how it is transformed, and how it is protected while moving between trusted institutions.

References

1. European Union, Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 25 and 32.
2. European Union Agency for Cybersecurity (ENISA). (2022). Data protection engineering [Technical report]. https://www.enisa.europa.eu/publications/data-protection-engineering
3. NIST, “Guidelines for Evaluating Differential Privacy Guarantees”, Special Publication 800-226. https://www.nist.gov/publications/guidelines-evaluating-differential-privacy-guarantees
4. European Union Agency for Cybersecurity (ENISA). (2023). Engineering personal data sharing: Emerging use cases and technologies. https://www.enisa.europa.eu/publications/engineering-personal-data-sharing