Chapter 41 — Privacy and data protection: system optimization | Engineering Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 41 published. Map, example, EX121.

flowchart TD
  N0["Learning outcomes"]
  N1["41.1 Optimisation goals"]
  N2["41.2 Removing redundancy"]
  N3["41.3 Trade-offs"]
  N4["41.4 Measuring the effect"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX121"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["41.1 Optimisation goals"]
  N2["41.2 Removing redundancy"]
  N3["41.3 Trade-offs"]
  N4["41.4 Measuring the effect"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX121"]

[Learning outcomes]
    |
    v
[41.1 Optimisation goals]
    |
    v
[41.2 Removing redundancy]
    |
    v
[41.3 Trade-offs]
    |
    v
[41.4 Measuring the effect]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX121]

Learning outcomes

You will (1) optimise for privacy and utility together; (2) remove redundant processing; (3) measure the effect of optimisation.

41.1 Optimisation goals

In the final year Zara looks for ways to improve Pellmore's platform as a whole. She defines goals: reduce personal data held, reduce processing steps that touch identifiable data, and keep or improve service quality. She measures the current state: total identifiable records, number of services with access to clinical data and median time to answer rights requests. Defining measurable goals first prevents optimisation from becoming a vague clean-up, and it lets her report progress in numbers that managers and the data protection officer can check.

41.2 Removing redundancy

Zara traces processing paths and finds redundancy: three services each keep a cache of patient names for display. She replaces the caches with a single name service that returns names only to authorised callers. She also finds that video recordings are transcoded into two formats, both stored. Only one is used. Removing the second format halves video storage. Each change reduces exposure without harming service, which she presents as the easiest kind of privacy improvement, often hidden in systems that grew without a plan.

41.3 Trade-offs

Some optimisations involve trade-offs. Shortening chat log retention from a year to six months reduces exposure but may hinder clinical follow-up. Zara asks clinicians, who agree that six months is enough for most cases, with an option to keep specific logs in the medical record when clinically relevant. She documents the decision with the reasoning. She notes that optimisation in privacy is rarely a pure technical exercise, because the right setting often depends on clinical and legal judgement that engineers must seek rather than assume.

41.4 Measuring the effect

After three months Zara measures again. Identifiable records have fallen by about a third, services with clinical access have fallen from eleven to six and rights requests are answered faster because data are in fewer places. She reports the results with their uncertainty and notes which changes contributed most. Prof. Holm points out that improvements in privacy often improve other qualities too, such as cost and performance, which helps privacy engineers win support for further work across the organisation. Storage costs fell noticeably too.

Worked example

Zara sets measurable optimisation goals, removes duplicate name caches and an unused video format, shortens chat retention with clinicians' agreement and measures a one-third fall in identifiable records.

Synthetic case. Figures are synthetic.

Errors and limits

Before-and-after comparisons can include unrelated changes; note other events in the period.

Exercises

EX121 — Name caches. How did Zara remove redundant name caches?
Show marking criteria
Rubric: 3 = replaced three caches with one name service for authorised callers;; 2 = mentions caches;; 1 = vague;; 0 = none.
EX122 — Clinical trade-off. How was chat log retention shortened safely?
Show marking criteria
Rubric: 3 = clinicians agreed to six months with the option to keep logs in the record when relevant;; 2 = mentions clinicians;; 1 = vague;; 0 = none.
EX123 — Services with access. How did the number of services with clinical access change?
Show marking criteria
Rubric: 3 = from eleven to six;; 2 = direction only;; 1 = wrong;; 0 = none.

Synthesis

Chapter 41 optimises the system. Chapter 42 turns to applied research.

Continue studying — chapter 41 of 50

← Chapter 40 (draft) · Course chapter index · Chapter 42 (draft) →