# A Framework for the Design of Privacy-Preserving Record Linkage Systems
## 3 System Design Framework for PPRL
### Architecture of PPRL Systems
In this system, linked de-identified data from two controllers is meant to be provided to users of a data platform for analysis. Each step of the process is marked in the figure and listed below. 1. Data controllers send the PII they use for linkage through a tokenizer to create linkage tokens and controller-specific tokens. 2. Tokens are then sent to the Honest Broker. 3. Data controllers provide to the data platform de-identified data with controller-specific tokens generated from the tokenizer. 4. The honest broker facilitates linkage by either providing mapping tables between the linkage tokens and controller-specific tokens or by providing the encryption keys that can decrypt the controller-specific tokens back into the linkage tokens. The linkage process can be performed automatically by the platform using the information provided by data controllers and the honest broker. 5. A qualified expert determiner examines the system and the processes performed by the data platform to ensure that no PII gets shared at any point in this process and may make recommendations for mitigating any privacy gaps if necessary. These recommendations could include modifications to the data flow, additional encryption steps, increasing the security context of the data platform, adding access controls, limiting the number or type of data queries, perturbing the linked data to prevent the data controllers from linking it to their original data, or others. 6. Data users are able to submit queries to the platform and receive the linked identified data they need for their analyses. They will not be able to see the process performed by the data platform to create the linked dataset. This system architecture is flexible in that it can accommodate any number of data controllers (our example shows just two for simplicity), multiple data platforms for analysis, multiple Honest Brokers for different linkage purposes, or even multiple Tokenizer tools. It is technology-agnostic, not requiring any specific hardware or software to be implementable. Figure 2: PPRL data flow architecture to create linked data. To ensure the system is privacy-preserving, the data flows as described between the different key roles in the system must be in place. The architecture of this system can be modified for other use cases as well. For instance, in some PPRL frameworks, instead of linking data, data controllers may be trying to determine whether they hold duplicate or redundant information between themselves. They may be performing this as a required step in data harmonization (e.g., removing duplicate records prior to combining their data, a process used within N3C [13]) or to identify individuals that are of interest because they appear in two different datasets (e.g., two states comparing data to find individuals who may have crossed state lines, a use case present in a pilot program that looked at linkage of Supplemental Nutrition Assistance Program (SNAP) recipients across state lines to prevent duplicate issuances of SNAP benefits [18]). In this case, the Honest Broker identifies overlapping linkage tokens, maps them back to controller tokens, and delivers the matched controller tokens back to their original data controller. Figure 3 is an architecture diagram showing the data flows for this use case, which is a simplified version of the diagram in Figure 2.