# A Framework for the Design of Privacy-Preserving Record Linkage Systems
## 2 What Is PPRL?  
PPRL is a family of techniques for enabling data linkage while protecting the privacy of data subjects. PPRL is intended to mitigate privacy risks and reduce barriers to data linkage and data use, enabling the access to and usage of linked data without needing to process large amounts of identifiable information [10]. Key to privacy protection in these systems is the requirement that no party within a PPRL system can access PII they do not already control [11; 15]. PPRL does this by enabling record linkages without using PII via tokenization, where the PII traditionally used for linkage is transformed in a reproducible manner into a unique identifier for data subjects and events associated with those data subjects [16; 17]. The tokens can then be matched across datasets to perform linkage instead of using the PII. Tokenization has the additional benefit of de-identifying the component datasets, enabling secondary usage without the need to obtain data subject consent [15]. Figure 1 shows an example of the design of a tokenizer.  
The current state of the art in tokenization uses a two-step process to generate linkage tokens and controller-specific tokens [12; 17]. First, PII used for linkage gets passed into the tokenizer, where a master salt (i.e., a special set of characters used by the tokenizer for linkage) gets added to the PII. The PII plus master salt is then passed through a one-way hashing algorithm to create the linkage token. This token will be the same for matching sets of PII regardless of the source, which is how it enables data linkage. The linkage token then undergoes a secondary encryption process using keys that are specific to each data controller, creating the controller-specific tokens. This token can be used by data controllers as unique identifiers for their data subjects, but they cannot use them for linkage on their own. Instead, a third party who holds the keys to decrypt the controller-specific tokens can transform them back into the linkage tokens and use that to perform linkage for data controllers. With secondary encryption, controllers can be sure that they do not reveal data subjects present in their data to other parties in the linkage process.  
While tokenization enables PPRL, to ensure privacy preservation throughout the linkage process, there needs to be additional technical and administrative controls designed into the record linkage system. While the requirement that no party within a PPRL system can access PII they do not already control is easy to understand, designing a record linkage system that can implement this requirement can be difficult with non-obvious pitfalls that put the privacy preservation of the system at risk. For instance, PPRL systems should allow original data controllers to be able to re-identify subjects in the data they provided.  
Figure 1: Example tokenizer design. Tokenization employs current generation cryptographic techniques such as Secure Hash Algorithm 2 (SHA-2) and Advanced Encryption Standard (AES). However, it is meant to be reversible; i.e., a mapping table exists between the tokens and the original PII that allows data controllers to recover the original PII if needed.  
However, they should not be able to re-identify those same data subjects in data provided by other parties. Additionally, in some use cases, controllers need to identify whether a data subject within their data can be found in another controller's data (a process known as de-duplication) without re-identifying the data subject in the other parties' data. Creating a system that can enable such complex and seemingly conflicting requirements requires careful design to ensure that privacy protections remain in place.