# A Framework for the Design of Privacy-Preserving Record Linkage Systems
###### Abstract  
Record linkage can enhance the utility of data by bringing data together from different sources, increasing the available information about data subjects and providing more holistic views. Doing so, however, can increase privacy risks. To mitigate these risks, a family of methods known as privacy-preserving record linkage (PPRL) was developed, using techniques such as cryptography, de-identification, and the strict separation of roles to ensure data subjects' privacy remains protected throughout the linkage process, and the resulting linked data poses no additional privacy risks. Building privacy protections into the architecture of the system (for instance, ensuring that data flows between different parties in the system do not allow for transmission of private information) is just as important as the technology used to obfuscate private information. In this paper, we present a technology-agnostic framework for designing PPRL systems that is focused on privacy protection, defining key roles, providing a system architecture with data flows, detailing system controls, and discussing privacy evaluations that ensure the system protects privacy. We hope that the framework presented in this paper can both help elucidate how currently deployed PPRL systems protect privacy and help developers design future PPRL systems. data privacy; record linkage; privacy-preserving record linkage; privacy enhancing technologies; systems design [table]capposition  
mitigation of which can create barriers to usage and sharing. For instance, data that contains identifiable information often cannot be used outside the purposes for which it was initially gathered without either obtaining additional consent or ensuring that the usage falls under specific allowances (e.g., public health emergencies) [7]. This limits the ability of researchers, analysts, and policymakers from using these data in identifiable formats, creating the need for de-identified data with sufficient privacy protections to ensure de-identification remains in place throughout the data usage lifecycle. After data is de-identified, traditional methods of record linkage cannot be performed because the identifying information necessary for linkage gets removed. To enable such linkage, a family of techniques known as privacy-preserving record linkage (PPRL) has been developed that leverage cryptography, secret sharing, and careful system design to ensure that individual privacy remains protected throughout the linkage process [8]. These techniques have undergone comprehensive review and evaluation for their utility in federal data linkage projects with investigations of both open-source and proprietary commercial systems [9; 10; 11; 12] and have been deployed in real-life data linkage and analysis systems such as that used by the N3C collaborative [13; 14]. Missing from the literature is a framework for the design and architecture of a PPRL system, describing the roles and responsibilities of the different parties involved within the system, the transfers of data and information flow between the different parties, the protections that need to be put in place, and the evaluations that need to be performed. The existing literature focuses on tooling and techniques, leaving information gaps around how to structure processes and organize data flows between the different parties. This gives the misconception that PPRL can be achieved solely through technical measures, overlooking that the process and people involved are just as important to ensuring privacy protection as the technology. The authors provide a framework for the design of PPRL systems within this paper, leveraging experience with real-world PPRL systems to provide a system architecture with broad applicability across many use cases. The focus of our framework is privacy protection; by having this focus, we can use this framework to both design systems that better protect privacy when linking data and explain to others how the system protects privacy in a simple and understandable manner.