# A Framework for the Design of Privacy-Preserving Record Linkage Systems
## 3 System Design Framework for PPRL
### System Controls for Privacy Protection  
To ensure the PPRL process remains privacy-preserving, in addition to the system architecture, privacy and security controls need to be put in place. The establishment of a set of controls typically involves working with data governance and privacy officers, performing evaluations such as Privacy Impact Assessments, Data-Protecting Impact Assessments, Vendor Risk Assessments, Business Impact Assessments, Enterprise Risk Assessments, and potentially Transfer Impact Assessments (used for transfers of data out of the European Union) to identify risks and then determining the best controls to deploy to mitigate those risks. Privacy and security controls utilized to mitigate risks typically include the following:  
* Data sharing agreements between controllers specifying the data they plan to share, who will have access and for what purpose, allowable data usages, term limits, and liabilities;
* Data use agreements for end users specifying the specific terms of use, including prohibitions against further data sharing without approval and re-identification of data subjects;  
Figure 3: PPRL data flow architecture for de-duplication.  
* Honest Broker agreements between controllers and Honest Brokers within the PPRL system, specifying the data Honest Brokers will receive from controllers, the allowed usages for said data, and whom the Honest Brokers can share data with;
* Business agreements with Tokenizer providers should Tokenization software need to be purchased or licensed;
* Policies at organizations receiving data (such as the Honest Broker, the host of the data platform, and the data users) that establish roles-based access to data, data protection, secure data storage, data retention and destruction, identity and authentication, regular monitoring of data access and data use, and oversight over the PPRL system;
* Sanctions for people who violate terms of agreements and privacy and security policies;
* Personnel granted with authority and responsibility for oversight over the system, which includes IT security, data privacy and protection officers, data governance and ethics councils, and data stewardship committees;
* Training on privacy, security, and confidentiality for staff who have access to the system and users of the data;
* Establishment of protocols for privacy breaches, including playbooks for containment, response, and informing those who are affected;
* IT technical controls that enable identity and authentication, role-based access, secure data storage, data retention and destruction, and monitoring of data access and data use;
* Secure transmission of data with encryption in transit to ensure sensitive information does not get leaked when transferring data between different parties in the system;
* Encryption and hardening of systems that hold sensitive information, such as the Honest Broker's environments that hold lookup tables between different sets of tokens;
* Implementation of anti-virus and anti-malware programs on all systems where data is stored;
* Physical and technical security for all systems where data is stored; and
* Regular review and security audits of the system.  
Several frameworks for establishing these controls exist that can be used to guide their implementation, such as the National Institute of Standards and Technology (NIST) Privacy Framework [19] and Cybersecurity Framework [20], International Standards Organization (ISO) and International Electrotechnical Commission (IEC) standards ISO/IEC 27001:2022 and ISO/IEC 27701:2019 [21; 22], Federal Information Security Modernization Act (FISMA) control levels [23], Systems and Organization Controls 2 (SOC 2) [24], and Health Information Trust Alliance (HITRUST) cybersecurity framework [25].