TripleBlind’s software-only solution unlocks the intellectual property value of healthcare data without exposing PHI. We address the California Consumer Privacy Act (CCPA) and reduce the burdens of compliance. By keeping data private and in place while allowing only authorized operations on the data, data providers and users can collaborate to analyze sensitive information without compliance violations or costly fines.
Under the CPPA, businesses are also required to give notices to consumers to explain their privacy practices. These requirements also apply to data brokers and providers.
Under California’s Civil Code section 1798.99.80, a data broker is “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.”
Businesses that meet any one of the following criteria must adhere to the CCPA:
Exemptions are provided for business regulated by other United States laws, including consumer reporting agencies, certain financial institutions, insurance companies, and health providers. These businesses are already subject to thorough federal data protection regulations, such as The Gramm-Leach-Bliley Act (GLBA), The Fair Credit Reporting Act (FCRA), and the Health Information Portability Act (HIPAA).
The CCPA defines “personal information” as “information that identifies, relates to, describes, is capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household.” This includes, but is not limited to:
Personal information under the CCPA does not include publicly available information, which is “information that is lawfully made available from federal, state, or local government records”. It does not mean biometric information collected by a business about a consumer without a consumer’s knowledge. It also does not include consumer information that is de-identified or aggregate consumer information.
We’re built to accelerate responsible innovation across enterprises. How? We never actually share raw personal information. In fact, we never even see it.
Data Subject Rights & Consent
The CCPA details 7 fundamental data subject rights. These include The Right to Disclosure, The Right to Access, the Right to be Forgotten, and more. Read about additional rights here.
The TripleBlind Solution
Our privacy-enhancing techniques keep data in place, allowing controllers and processors of data to interact in a peer-to-peer software environment. While TripleBlind is not responsible for an organization’s internal or external privacy policies and practices, we provide an environment for vendors to collaborate with sensitive data and promote CCPA compliance.
Use of Deidentified Data
The CCPA specifies that deidentified data may be used by a business when the business:
The TripleBlind Solution
TripleBlind never stores, sells, or handles any personal data. TripleBlind’s technology permanently and irreversibly de-identifies data through a combination of one-way encryption and distributed computing, which allows the algorithm to generate the same outputs without requiring an Algorithm Provider to process or use any data within the scope of the CCPA’s definition of personal information.
Technical Safeguards
The CCPA allows for business and research uses of deidentified data under the previously stated conditions.
The TripleBlind Solution
The TripleBlind Solution offers additional technical safeguards through our robust digital rights management (DRM). Each data operation must be explicitly approved by the appropriate administrator. Once approved, the dataset is one-way encrypted for one-time use. Once the operation is complete and the result is returned to the appropriate party, the one-way encrypted data is rendered useless. Permissions can be set as broadly or specifically as needed, to govern both internal and external use of an organization’s information assets.
Since the TripleBlind Solution advanced one-way encryption model keeps data and algorithms private at every stage of a data project and never stores data itself, covered entities can collaborate with underutilized datasets and algorithms without fearing unauthorized access to personal data. When combined with our comprehensive Digital Rights Management (DRM) system, global organizations can safely unlock sensitive data for faster innovation across industries.
Interested in learning more about practical applications of the TripleBlind Solution?
Check out the following use cases of our product:
TripleBlind’s innovations build on well understood principles of data protection. Our innovations radically improve the practical use of privacy preserving technologies, by adding true scalability and faster processing, with support for all data and algorithm types. We support all cloud platforms and unlock the intellectual property value of data, while preserving privacy and enforcing compliance with HIPAA and GDPR.