Privacy & Compliance · Study deck
Privacy-Preserving Techniques for IoT
Picture a care-home room sensor that must report whether help may be needed.
Privacy Priya is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: Encryption, Access, and Advanced Computation Encryption gives confidentiality in transit and at rest, but the technique question is whether the raw data should exist, who can decrypt it, and what happens when the purpose ends.
- Explain: For narrow, high-sensitivity workflows, specialized methods such as secure enclaves, secure multi-party computation, and homomorphic encryption can compute on protected data, but they are targeted tools, not general replacements for minimization.
- Explain: Shrink what the system learns, separate identity from behavior, release summaries instead of raw trails, and then protect the remaining data with access controls, encryption, and evidence.
Major section
Start With the Smallest Useful Signal
It may not need names, a full path, or a long record of each move.
- Keeping more data can make later work easy, but it also makes loss and misuse more harmful.
- Hiding a name may still leave a clear pattern that points to one person.
- Encryption is not minimization Encryption protects confidentiality.
Major section
Start With the Smallest Useful Signal (continued)
Privacy-preserving techniques are not interchangeable settings you flip on at the end.
- The later checks show what each method can and cannot protect.
- A gateway is a local bridge that can reduce data before it leaves a site.
- “The safest data is the data you never collected — justify every field before it reaches storage.”.
Major section
Start With the Smallest Useful Signal (continued)
Shrink what the system learns, separate identity from behavior, release summaries instead of raw trails, and then protect the remaining data with access controls, encryption, and evidence.
- The strongest move is also the simplest: data you never collect, keep, or transmit cannot leak, be overused, or trigger a deletion request later.
- So the first question is not "how do we hide everything after collection?" but "what is the smallest amount of information that delivers the product?".
- If you only need the intuition, this layer is enough: minimize first, then reduce identity, then release only summaries or results.
Major section
Start With the Smallest Useful Signal (continued)
Encryption is essential but it is not minimization, because an encrypted location trail is still a location trail.
- Here Priya walks the technique stack in order: what gets minimized first, why each layer earns its place, and where the guarantee actually stops.
- The aim is to change what the system holds, not just to lock it up.
- The One-Minute View Reduce before protecting Minimization changes the requirement, not just the safeguard.
Major section
Build the Technique Stack
The practical job is to assemble a technique set that fits the data, the purpose, and the architecture, then to leave evidence for the next reviewer.
- Records that must persist but should not name a person.
- A stable token still tracks behavior and can join across datasets.
- Raw signals the cloud does not need to see.
Major section
Build the Technique Stack (continued)
Calibrated noise so one contributor barely changes a result.
- Shared model from distributed updates, not centralized records.
- Model updates can still leak; treat the update path as sensitive.
- If you can build a layered technique set and record why each piece was chosen, you can stop here.
Major section
Know Each Mechanism's Guarantee
Mechanisms, Guarantees, and Limits still matter after the simple design move.
- The word names where a technique stops protecting the data.
- The recurring lesson is that every technique has a precise scope, and using it outside that scope quietly removes the protection.
- Differential Privacy Differential privacy is a release technique for aggregate results.
Major section
Know Each Mechanism's Guarantee (continued)
The data simply is not there to leak or reuse.
- Anonymization vs Pseudonymization Pseudonymization replaces a direct identifier with a token but keeps a key that can reverse it, so pseudonymous data is still personal data and still regulated.
- "Collect now, decide later" keeps everything forever.
- One contributor barely changes a released statistic.
Major section
Know Each Mechanism's Guarantee (continued)
Anonymization aims to make re-identification infeasible even with effort, after which the data is no longer personal.
- The gap between them is re-identification through quasi-identifiers: fields like precise location and exact time that are unique in combination, joinable to outside data.
- Second, repeated releases consume a cumulative privacy budget; many small queries erode the guarantee, so the budget must be tracked.
- Minimum group size, suppression of rare cells, query controls.
Major section
Know Each Mechanism's Guarantee (continued)
The noise level is a deliberate design parameter; this chapter keeps it qualitative rather than inventing a value.
- Federated Learning Federated learning trains a shared model from distributed updates: each device or gateway learns locally on its own data, sends only a model update, and receives a new global model.
- This reduces raw-data centralization, but it does not erase privacy risk, because the updates themselves can reveal rare or memorized behavior.
- Separate key access from broad application access, and use role boundaries, approval paths, audit logs, and short-lived grants for any exceptional raw-data use.
Major section
Know Each Mechanism's Guarantee (continued)
Encryption, Access, and Advanced Computation Encryption gives confidentiality in transit and at rest, but the technique question is whether the raw data should exist, who can decrypt it, and what happens when the purpose ends.
- For narrow, high-sensitivity workflows, specialized methods such as secure enclaves, secure multi-party computation, and homomorphic encryption can compute on protected data, but they are targeted tools, not general replacements for minimization.
- Noise on a dashboard while raw records stay broadly readable.
- A trustworthy review names the technique, the threat it handles, the test that proved it, and the limit that remains.
Deck summary
Key takeaways
It may not need names, a full path, or a long record of each move.
- Privacy-preserving techniques are not interchangeable settings you flip on at the end.
- Shrink what the system learns, separate identity from behavior, release summaries instead of raw trails, and then protect the remaining data with access controls, encryption, and evidence.
- Encryption is essential but it is not minimization, because an encrypted location trail is still a location trail.
- The practical job is to assemble a technique set that fits the data, the purpose, and the architecture, then to leave evidence for the next reviewer.
Retrieval practice
Recall check 1 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q1A team wants to show weekly building occupancy trends. Raw motion events are not needed once the trend is computed. What is the best first privacy technique?
Show answer
Answer: A Compute only the summaries needed for the trend and delete the raw events once the purpose is fulfilled.
Retrieval practice
Recall check 2 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q2An operations dashboard reports occupancy per zone and shows 'one device changed state' in a zone that has a single occupant. What is the problem, and the right fix?
Show answer
Answer: A A count of one is not anonymous.
Retrieval practice
Recall check 3 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q3When is differential privacy a good fit for an IoT system?
Show answer
Answer: B Differential privacy is a release method for aggregates over many contributors; it depends on sensitivity analysis and a tracked, cumulative budget.
Print reference
Answers
Answer key.
- A · Compute only the summaries needed for the trend and delete the raw events once the purpose is fulfilled.
- A · A count of one is not anonymous.
- B · Differential privacy is a release method for aggregates over many contributors; it depends on sensitivity analysis and a tracked, cumulative budget.