Analyzing PETs for Enterprise Operations

Abstract

Enterprises (large, often highly distributed organizations) in both the private and public sectors are increasingly recognizing the need to comprehensively address privacy risk. This entails, as it does for information security, a systematic combination of people, processes, and technology. However, while establishing roles and processes governing the management of personally identifiable information (PII) can be done fairly readily (assuming availability of the necessary expertise and experience), finding and deploying appropriate enterprise technology— commercial or open source—is proving more problematic. A technological model targeted at enterprises (i.e., data stewards) differs from one targeted at individuals (i.e., data subjects). However, the privacy-enhancing technology research community has tended to focus more on the latter than on the former. Furthermore, various enterprise technologies exist with capabilities that can support privacy, even if not specifically intended to do so. We have adopted the term privacy-enabling technologies (PETs) to denote the expansiveness of this field.