Chapter 26 — Privacy and data protection: architecture alternatives
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Three architectures"]
N2["26.2 Privacy-enhancing technologies"]
N3["26.3 Scoring"]
N4["26.4 Decision"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Three architectures"]
N2["26.2 Privacy-enhancing technologies"]
N3["26.3 Scoring"]
N4["26.4 Decision"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Three architectures]
|
v
[26.2 Privacy-enhancing technologies]
|
v
[26.3 Scoring]
|
v
[26.4 Decision]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) compare centralised, federated and on-device architectures; (2) evaluate privacy-enhancing technologies; (3) choose with documented criteria.
26.1 Three architectures
Pellmore wants to analyse consultation outcomes across clinics to improve care. Zara compares three architectures. Centralised: copy all records to one analytics store. Federated: run analyses within each clinic's system and share only results. On-device or edge: compute statistics at the point of care. Centralisation is simplest but concentrates risk. Federation keeps raw data local but complicates analysis. She writes criteria before comparing: data exposure, analysis capability, cost, operational complexity and ability to honour erasure requests across the system. Each criterion is scored from one to three before any design discussion.
26.2 Privacy-enhancing technologies
Zara surveys privacy-enhancing technologies. Differential privacy adds calibrated noise to outputs, following Dwork and colleagues (2006). Secure multi-party computation lets parties compute joint results without revealing inputs. Synthetic data can replace real records for development. Each has limits: differential privacy reduces accuracy, especially for small groups; multi-party computation is complex and slow; synthetic data may leak if generated carelessly from real records. NIST SP 800-188 discusses several of these approaches for government data releases, which she finds transferable to health statistics. Synthetic data suit testing well.
26.3 Scoring
Zara scores each architecture on her criteria with the team. Federation with differentially private aggregated outputs scores best on exposure and erasure, adequate on analysis and worse on complexity. Centralisation scores best on analysis and worst on exposure. She presents the scores with their reasoning, stressing that the weights reflect Pellmore's priorities, which management must confirm. The EDPB guidelines on data protection by design list the state of the art and cost of implementation as factors, which supports making these trade-offs explicit.
26.4 Decision
Pellmore's architecture board chooses federation with aggregated outputs for clinic comparisons, and a small centralised, pseudonymised dataset for clinical safety audits that need record-level data under strict access. Zara records the decision, the alternatives rejected and the conditions for revisiting it. She notes that the hybrid answer is common in practice: no single architecture fits all purposes, and documenting which purpose uses which architecture helps auditors and future engineers understand the system and resist pressure to centralise everything for convenience. The decision record names owners.
Worked example
Zara compares centralised, federated and edge architectures against pre-set criteria, surveys privacy-enhancing technologies and records a hybrid decision: federation for comparisons, a restricted pseudonymised set for safety audits.
Synthetic case. The architectures and scores are synthetic; Dwork et al. (2006), NIST SP 800-188 and EDPB Guidelines 4/2019 are real.
Errors and limits
Scores depend on weights; show sensitivity to different weights.
Exercises
- EX076 — Centralisation trade-off. What is the main trade-off of centralisation? Rubric: 3 = easiest analysis but concentrated exposure;; 2 = mentions risk;; 1 = says best overall;; 0 = none.
- EX077 — PET limits. Name a limit of each of two privacy-enhancing technologies. Rubric: 3 = e.g. DP loses accuracy for small groups; MPC is complex and slow;; 2 = one;; 1 = vague;; 0 = none.
- EX078 — Hybrid decision. What did the architecture board decide? Rubric: 3 = federation for comparisons plus a restricted pseudonymised set for safety audits;; 2 = one part;; 1 = centralise;; 0 = none.
Synthesis
Chapter 26 chooses architectures. Chapter 27 designs controls.
Continue studying — chapter 26 of 50
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →