# A Framework for the Design of Privacy-Preserving Record Linkage Systems
## 3 System Design Framework for PPRL
### Architecture of PPRL Systems  
As the primary goal of PPRL is to link data while protecting privacy, that is, to link data without any party to the linkage obtaining PII they do not already possess, the system must be designed so that flows of data do not involve transfer of PII outside of any individual party's control. Key to enabling this goal are the Tokenizer and the Honest Broker; the Tokenizer masks PII used for linkage before it gets transferred outside a data controller's security perimeter, and the Honest Broker facilitates the linkage so that controllers do not need to handle tokens generated from another controller's data. Figure 2 shows the architecture of the PPRL system, focusing on data flows between different parties in the system, with the goal of creating a linked dataset for analysis. \begin{table}
\begin{tabular}{c c} \hline \hline
**Party** & **Roles and Responsibilities** \\ \hline \multirow{8}{*}{**Expert Determiner**} & **Role**: Evaluates and provides evidence (i.e., a report) that shows that what is being planned with the data does not violate the privacy rights of data subjects \\ \cline{2-3}  & **Responsibility**: Provides an unbiased evaluation of the privacy risks to data subjects from the anticipated usage and data linkages and, if there are risks, provides recommendations for mitigation strategies to address those risks. \\ \cline{2-3}  & The expert determiner may evaluate data subject identifiability before and after linkage, privacy and security controls on a system, end data user motives and capacity for privacy violations (including data access and use limitations), and likelihood of data breach. The determination may recommend additional transformations be applied to the data or additional controls be put in place. \\ \hline \multirow{8}{*}{**Privacy Officer**} & **Role**: Knowledgeable expert in privacy-related matters who can help identify and address privacy-related issues when handling PII. \\ \cline{2-3}  & **Responsibility**: Provides guidance on privacy-related matters on projects where PII is being handled to ensure compliance with regulations and policies. Assists with system design to ensure privacy principles are followed throughout the data lifecycle. \\ \hline \multirow{8}{*}{**Data Platform**} & **Role**: Provides the hosting environment where individual unlinked datasets and linked datasets are stored and may also provide a computational platform for data users to access, process, and analyze said data. \\ \cline{2-3}  & **Responsibility**: Implement the necessary privacy and security controls to protect the data hosted on the platform and provide analytic tools to end users for data processing and analysis. Platforms may be the enablers of PPRL, as the actual linkage process may take place on the platform using analytic tools provided within the platform. Platforms may also be the best place to implement technical privacy and security controls, such as limits on downloading data, access controls, and logging and monitoring data use. \\ \hline \multirow{8}{*}{**Data Governance**} & **Role**: Provides the rules within which the system operates and oversight to ensure rules are followed. \\ \cline{2-3}  & **Responsibility**: Development of the rules that govern the data system, including the privacy and security controls that must be followed, access control procedures, roles and responsibilities of different parties in the system, contractual terms and agreements, data retention and destruction policies, quality rules, data and metadata standards, and regular monitoring and auditing. Provides oversight over data governance rules to ensure that they are followed. \\ \hline \multirow{8}{*}{**Data Users**} & **Role**: End users of the data product. \\ \cline{2-3}  & **Responsibility**: Process and analyze the data according to the requirements and limitations set down within the data access and use agreements they sign. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Cont.