Important concepts. Key thing that has changed in privacy in last couple years is that de-identified data has recently been made into a legal concept instead of

Important concepts. Key thing that has changed in privacy in last couple years is that de-identified data has recently been made into a legal concept instead of a technical one, whereby you do a re-identification risk assessment (not a very mature methodology in place yet), figure out who is accountable in the event of a breach, label the data as de-identified, and include the obligation of the recipients to protect it in the data sharing agreement. The effect on data sharing has been notable because nobody wants to hold risk, where previously "de-identification" schemes (and even encryption) made their risk and obligation evaporate as it magically transformed the data from sensitive to less sensitive using encryption or data masking. Privacy Preserving Data Publishing is sympathetic magic from a technical perspective, as it just obfuscates the data ownership/custodianship and accountability. FHE is the only candidate technology I am aware of that meets this need, and DBAs, whose jobs are to manage these issues, are notoriously insufficiently skilled to produce even a synthesized test data set from a data model, let alone implement privacy preserving query schemes like differential privacy. What I learned from working on the issue with institutions was nobody really cared about the data subjects, they cared about avoiding accountability, which seems natural, but only if you remove altruism and social responsibility altogether. You can't rely on managers to respect privacy as an abstract value or principle. Whether you have a technical or policy control is really at the crux of security vs. privacy, where as technologists we mostly have a cryptographic/information theoretic understanding of data and identification, but the privacy side is really about responsibilities around collection, use, disclosure, and retention. Privacy really is a legal concept, and you can kick the can down the road with security tools, but the reason someone wants to pay you for your privacy tool is that you are telling them you are taking on breach risk on their behalf by providing a tool. The people using privacy tools aren't using them because they preserve privacy, they use them because it's a magic feather that absolves them of responsibility. It's a different understanding of tools. However, it does imply a market opportunity for a crappy snakeoil freemium privacy product that says it implements the aformentioned techniques but barely does anything at all, and just allows organizations to say they are using it. Their problem isn't cryptographic, it just has to be sophisticated enough that non-technical managers can't be held accountable for reasoning about it, and they're using a tool so they are compliant. I wonder what the "whitebox cryptography" people are doing these days...