PROVISION OF SERVICES FOR: PRIVACY ENHANCING TECHNOLOGIES: ADDRESSING THE USER CONFIDENCE GAP: CERTIFICATIONS, ASSURANCE SCHEMES AND RISK ASSESSMENT TOOLKITS

The Royal Society's Data Programme is developing policy and promoting debate that helps the UK safely and rapidly realise the growing benefits of data and digital technologies. In 2019, the Royal Society launched the report Protecting privacy in practice: The current use, development and limits of Privacy Enhancing Technologies in data analysis. One of our activities following from this report is an exploration of the status and role of Privacy Enhancing Technologies (PETs): technologies or conceptual approaches that allow the derivation of useful insights from data without requiring full data access. Some examples include homomorphic encryption, zero knowledge proofs, differential privacy and secure multi-party computation. The Royal Society has launched a refresher project to update the 2019 report, which will be published in late 2021. This shall include an updated review of PETs applications, legal / regulatory concerns and an illustrative set of use cases. This commissioned review is a foundational piece of our evidence gathering for this project; it will inform our understanding of the regulatory landscape and possible futures with regard to PETs. The Society seek to engage a Supplier to provide a review in three parts: 1. a review of certification and assurance of PETs; 2. an overview of certification and assurance practices in cybersecurity since 2000; and 3. a synthesis discussion that draws from both reviews to identify transferrable lessons from the recent history of cybersecurity assurance that may (or may not) apply to PETs. Please see Attachment 1 - The Brief for more details.