While many rightly point to difficulties in overcoming legal and technical hurdles, these challenges are not insurmountable. The major barriers to secure data sharing that exist today include the fact that:

1. Trust remains elusive. In a 2018 EU survey of European companies on B2B data, companies indicated that a lack of control over the usage of data by other organizations (42 percent) was as much of a barrier to data sharing as legal uncertainty over data ownership rights (54 percent), and 15 percent of respondents also cited the uncertainty of liability costs in case of damage caused by data sharing as another barrier. Trust between parties is imperative, but traditional trust architectures are incapable of solving this unique problem of data sharing because they do not protect companies against the extended consequences it presents; the risk gap remains too large when considering sensitive data.
2. The risk of sharing data is disproportionally higher than the potential value of sharing data⁠—even in the presence of trust.Accenture research on the impact of revenue on companies after a large, public data breach shows that companies can see an almost 10 percent-decline in revenue for up to six months after the breach compared to companies who did not suffer a breach. Worse, it can take almost two years to recover that lost revenue, by which time those companies could be even further behind their competitors.

Privacy Preserving Computation (PPC) techniques are a family of very modern cybersecurity techniques that, instead of focusing on protecting data from access by unauthorized parties, look at how to represent data in a form that can be shared, analyzed and operated on without exposing the raw information. Encryption techniques often form the core of how PPC techniques provide these capabilities, but they are used in a slightly different way than usual.

While these PPC techniques and technologies are still new, they are rapidly maturing and are now at a point where they can be used in real business use cases. Securing data at rest, in transit and even during computation is now possible using Trusted Execution Environments. Publicly sharing statistical data without compromising the privacy of individual records is now possible with Differential Privacy. Analyzing encrypted data is now possible thanks to the development of encryption schemes, such as Homomorphic Encryption. Through these technologies, sensitive data can be encrypted and protected at all stages and can be used by a number of trusted or untrusted parties to generate insights without unintentionally exposing data.

With this peace of mind, PPC techniques open many new opportunities for enterprise collaborations that were not previously possible due to risk or regulation. Beyond the traceability and control of data considerations, these technologies enable partners to work in a decentralized way, giving them the opportunity to jointly investigate common or shared business issues. Companies are also able to apply AI and improved analysis methods to datasets that they had not previously had access to. This means collaborations with external parties—even competitors—are now possible, and in some cases, well underway.

As discussed, innovative companies have already begun to deploy PPC techniques in real-world scenarios, combining internal capabilities with external PPC expertise. Enterprises looking to embrace these possibilities need to:

• Calibrate Understanding: PPC techniques have a variety of strengths and weaknesses and are currently suited to specific applications and data requirements. Companies should develop a calibrated understanding of what is realistic today, where these technologies can be applied in their industry and which PPC techniques are fit for their specific goals.
• Identify Opportunities: Companies should work with ecosystem partners to identify previously inaccessible data-sharing opportunities, or look at existing high-risk, cumbersome data-sharing processes that may be suitable for initial test and validation. In particular, AI drives these opportunities with companies looking to gain clearer insight via wider access to data beyond what each can provide on its own. Because PPC techniques operate without the raw data ever being revealed, they lower the barrier to data use.
• Co-Create: Companies should look to foster innovation and co-create with trusted partners that have expertise in the area of PPC techniques and tangential technologies like blockchain and cybersecurity to help improve existing tools and technologies and to fashion new tools in these areas that we don’t yet know we’ll need.
• Think long term: With further development, PPC techniques have the potential to be a major disrupter of traditional data-driven business models while also democratizing the raw materials of AI as they can support decentralized algorithm development rather than being dependent on a few large AI vendors. Companies should start to think long term, investigating opportunities to use these techniques in conjunction with other technologies to create new value.

With the growing argument for ecosystem collaboration and the need for effective and secure methods of data exchange and collaboration, PPC techniques and their successors will be critical to effective, safe and secure data sharing. This in turn will be fundamental for businesses to gain value from their data and provide new avenues for disruption. We’re on the path to industrializing PPC offerings so our clients can take advantage of new near- and long-term opportunities. Let’s talk about what that could mean for your business.

*Glossary of terms:

Data Obfuscation: The process of hiding the original data by modifying the content, i.e. by replacing certain parts of the content with meaningless content while keeping the data usable. Usually used to protect sensitive or personally identifiable data and is also referred to as Data Masking.

Anonymization/De-identification: Refers to types of obfuscation that are intended to maintain privacy by replacing personally identifiable content, i.e. names, addresses, phone numbers etc., with values that don’t have direct relationships to that person.

Internet of Things (IoT): Refers to the embedding of systems and sensors into physical devices and objects that allow them to interconnect with each other and to the wider internet without human intervention.

Field Programmable Gate Arrays: Types of microchips that allow their own internal configuration to be configured by end users or integrators that allow the chips to be set up in a way that is tuned and tailored to the exact use case of the owner. This allows greater performance to be achieved by using hardware tailored for a given purpose without the need to commission custom hardware.

General Purpose Graphics Processing Units (GPGPUs): Hardware chips specifically designed to handle the highly parallel tasks of rendering and refreshing complex (2D and 3D) graphics on a screen. It was found that these same chips were much more efficient than standard CPUs at doing other processing tasks with parallel loads. GPGPUs are an extension of the same types of chip but tailored further toward more general parallel data processing than graphics processing.

Federated Learning: An approach to machine learning for training a central, shared model using data that is distributed across multiple locations rather than available centrally. It has applicability where all the training data is not available in the same place or at the same time or where it is not possible or desirable to bring the training data into a central location. It allows the data to be used where it exists without the need to remove it from its location (i.e. a mobile phone or other device) and then uplinks the learnings back into the central model without having to send the actual data back.