{"id":197,"date":"2022-12-16T23:21:08","date_gmt":"2022-12-16T23:21:08","guid":{"rendered":"https:\/\/semla.dfki.de\/?page_id=197"},"modified":"2025-04-11T10:56:13","modified_gmt":"2025-04-11T10:56:13","slug":"white-paper","status":"publish","type":"page","link":"https:\/\/semla.dfki.de\/de\/white-paper\/","title":{"rendered":"White paper"},"content":{"rendered":"
\n
<\/div>\n\n\n\n
\n

SEMLA<\/a><\/h1>\n\n\n

An On-Premises Trusted Research Environment for AI-based R&D with Sensitive Personal Information<\/p>\n\n\n\n

Jan Alexandersson, Jochen Britz, Valentin Seimetz, Daniel Tabellion<\/p>\n\n\n\n

DFKI GmbH<\/p>\n\n\n\n

1. Introduction<\/h1>\n\n\n\n

We are witnesses to huge and rapid advancements in technical systems based on artificial intelligence (AI). The steady growth in computing power, both in terms of CPU and GPU, along with free access to machine learning libraries fuels this development and the sheer output from the research community as well as the emergence of products with AI technology on the market is impressive. Data of all kinds, be it weather, financial developments, local traffic information alongside personal preferences, biometric data and even diseases make it possible to provide services that go beyond imagination. However, we also see developments where this kind of data is used for unintended or undesired purposes: once information has been published globally on the internet or collected within datasets, not necessarily permitted by the data owner, it is nearly impossible to undo or delete this information.<\/p>\n\n\n\n

In Europe, the enactment of the General Data Protection Regulation (GDPR) has on the one hand raised awareness of these risks and, on the other hand, prescribed how personal data must be treated, thus increasing demand for fair and secure handling of this data. GDPR put personal data of individuals and their right1<\/a><\/sup>EU Charter of Fundamental Rights (Art. 8) states: personal data “\u2026 must be processed fairly for specified purposes and on the basis of consent of the person concerned or some other legitimate basis laid down by law.”<\/span> to own, grant usage and retract consent at its core. The research community is obliged to follow strict rules, e.g., minimizing data usage, pseudonymizing and\/or anonymizing data and even deleting data after the research task has been accomplished. Consequently, within research and development there is a need for a new level of so-called Trusted Research Environments (TRE) where the GDPR regulations are in focus. Fortunately, we witness well-founded advancements in this area too. Both cloud-based approaches, like (O’Reilly, 2020; Arenas et al, 2019) as well as classification schemata, e.g. (LfD, 2018; TCPD, 2016 \u2013 both in German) provide a solid basis for the infrastructure that implements most of European and international legislation requirements on processing security. The latter schemata also consider cases which go beyond this work, such as data concerning witness-protection program and state security.<\/p>\n\n\n\n

This work is mainly motivated by DFKI\u2019s involvement in research and development of biomarkers, digital phenotyping, and decision support systems in the healthcare domain. Some examples are:<\/p>\n\n\n\n