TripleBlind’s software-only solution unlocks the intellectual property of sensitive data without exposing private information. We address the GDPR and reduce the burdens of compliance. By keeping data private and in place while allowing only authorized operations on the data, global organizations can collaborate around personal data without fear of compliance violations or costly fines.
The GDPR is one of the most comprehensive data protection regulations in the world. With applications for nations inside and outside of the EU, any organization seeking to work with European companies or users must comply with requirements set forth by the GDPR.
Non-compliance is costly –– infringements could cost organizations a fine of up to $20.8 million dollars, or 4% of the organization’s worldwide annual revenue from the preceding financial year, whichever is higher.
What if you found a solution that could remove liabilities without restricting the utility of personal data?
Under Article IV of the GDPR, “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular reference to an identifier such as a name, and identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;”
This definition is incredibly broad, but can encompass information such as:
We’re built to accelerate responsible innovation in high-impact industries. How? We never actually share personal data. In fact, we never even see it.
Despite the risks and challenges of the GDPR, there are many forms of collaboration involving personal data that are beneficial to organizations, individuals, and society as a whole. For example, personal data can help medical researchers find cures for diseases. Personal data can help improve algorithm development through machine learning, which can help organizations realize increased efficiency and also help reduce the downsides of artificial intelligence through improvements (for example, helping to train facial recognition technology to minimize the risk of bias).
TripleBlind’s technology can help enable this collaboration to occur in a manner that decreases the parties’ costs in complying with certain GDPR requirements and their exposure to privacy risks.
Lawful, Fair, and Transparent Processing
“Personal data shall be: (a) processed lawfully, fairly, and in a transparent manner in relation to the data subject.”
The TripleBlind Solution
The GDPR applies to the processing of personal data. Conversely, the GDPR does not apply to the processing of anonymous data (data from which an individual may not be identified, either on its own or in combination with other data).
TripleBlind’s technology is designed to help parties achieve the same outcomes through the processing of anonymous data as would ordinarily be obtained through the processing of personal data.
TripleBlind splits the processing of anonymized data between the Data Provider and the Algorithm Provider, but also includes measures to prevent the Algorithm Provider from obtaining access to other information needed to identify an individual –– satisfying the conditions for which processing is lawful under Article VI of The GDPR.
Limitation of Purpose, Data, and Storage
“Personal data shall be: (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); and (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.”
The TripleBlind Solution
TripleBlind never stores or handles any personal data. TripleBlind’s technology permanently and irreversibly de-identifies data through a combination of one-way encryption and distributed computing, which allows the algorithm to generate the same outputs without requiring an Algorithm Provider to process or use any data within the scope of the GDPR’s definition of personal data.
Data Subject Rights & Consent
The GDPR details 8 fundamental data subject rights. These include the Right to Access, Right to Rectification, Right to Erasure, and more. For additional rights specified under the GDPR, read here.
The TripleBlind Solution
TripleBlind provides robust digital rights management (DRM). Each data operation must be explicitly approved by the appropriate administrator. Once approved, the dataset is one-way encrypted for one-time use. Once the operation is complete and the result is returned to the appropriate party, the one-way encrypted data is rendered useless. Permissions can be set as broadly or specifically as needed, to govern both internal and external use of an organization’s information assets.
Since TripleBlind never stores, handles, or processes personal data, our technology helps minimize privacy risks and infringement on data subjects’ rights when working between vendors.
Privacy By Design
“The term “Privacy by Design” means nothing more than “data protection through technology design.” Behind this is the thought that data protection in data processing procedures is best adhered to when it is already integrated in the technology when created.”
The TripleBlind Solution
TripleBlind was built with privacy and security in mind, allowing your data to remain behind your firewall while it is made discoverable and computable by third parties for analysis and ML training.
The TripleBlind Solution has also obtained SOC 2 Type 1 certification for our commitment to establish and follow security policies and procedures. Learn more here.
Data Protection Impact Assessments
“Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.”
The TripleBlind Solution
TripleBlind provides robust digital rights management (DRM). Each data operation must be explicitly approved by the appropriate administrator. Once approved, the dataset is one-way encrypted for one-time use. Once the operation is complete and the result is returned to the appropriate party, the one-way encrypted data is rendered useless. Permissions can be set as broadly or specifically as needed, to govern both internal and external use of an organization’s information assets.
Accountability in the Event of a Data Transfer
“Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation.”
The TripleBlind Solution
The TripleBlind Solution does promote sharing or storage of personal or raw data. Since data never changes hands and remains behind each parties’ firewall when using our API, the TripleBlind Solution reduces the risk of compliance failures with respect to data transfers.
Assignment of a Data Protection Officer
Article 37 of the GDPR specifies requirements for the designation of a data protection officer for controllers and processors of data here.
The TripleBlind Solution
Our privacy-enhancing techniques keep data in place, allowing controllers and processors of data to interact in a peer-to-peer software environment. While TripleBlind is not responsible for the assignment of a Data Protection Officer at an organization, we provide an environment for vendors to collaborate with sensitive data and ensure GDPR compliance.
Security Awareness & Training
“The duties of a Data Protection Officer include: Working towards the compliance with all relevant data protection laws, monitoring specific processes, such as data protection impact assessments or the awareness-raising and training of employees for data protection, as well as collaborating with the supervisory authorities.”
The TripleBlind Solution
This requirement is about the data owners’ staffing and training and is not applicable to the use of software to protect data privacy, except for the training on the proper use of TripleBlind software that we provide.
Since the TripleBlind Solution advanced one-way encryption model keeps data and algorithms private at every stage of a data project and never stores data itself, covered entities can collaborate with underutilized datasets and algorithms without fearing unauthorized access to personal data. When combined with our comprehensive Digital Rights Management (DRM) system, global organizations can safely unlock sensitive data for faster innovation across industries.
Interested in learning more about practical applications of the TripleBlind Solution?
Check out the following use cases of our product:
TripleBlind’s innovations build on well understood principles of data protection. Our innovations radically improve the practical use of privacy preserving technologies, by adding true scalability and faster processing, with support for all data and algorithm types. We support all cloud platforms and unlock the intellectual property value of data, while preserving privacy and enforcing compliance with HIPAA and GDPR.