Adopt a PET! An Exploration of PETs, Policy, and Practicalities for Industry in Canada

Privacy enhancing technologies (PETs) are technical solutions for privacy issues that exist in our digital society. Despite increased privacy challenges and a corresponding increase in new regulations being proposed by governments across the globe, a low adoption rate of PETs persists. In this work, we investigate the relationship that new privacy regulations have on industry's decision-making processes as well as the extent to which privacy regulations inspire the adoption of PETs. We conducted a qualitative survey study with 22 industry participants from across Canada to investigate how businesses in Canada make decisions to adopt novel technologies and how new privacy regulations impact their business processes. Through this study, we identify the breadth of approaches employed by organizations considering PETs and the challenges they face in their efforts to ensure compliance with all pertinent laws and regulations. We further identify a gap between how companies think of privacy technologies and how researchers think of privacy technologies that can contribute to low adoption of the increasingly sophisticated privacy technologies produced by researchers, such as applications of differential privacy, multiparty computation, and trusted execution environments. Informed by the results of our analysis, we make recommendations for industry, researchers, and policymakers on how to support what each of them seeks from the other when attempting to improve digital privacy protections. By advancing our understanding of what challenges industry faces in ensuring compliance with novel and existing privacy regulations, we increase the effectiveness of future privacy research that aims to help overcome these issues.