Privacy Requirements and Realities of Digital Public Goods

Digital Public Goods (DPGs) are a recent concept describing open-source digital artifacts (e.g., software, datasets) that aim to address the UN Sustainable Development Goals. DPGs are increasingly being used to deliver essential government services around the world (e.g., ID management, healthcare registration). The privacy risks of DPGs are currently managed in part by the DPG standard, which is a prerequisite checklist for being classified a DPG; the standard includes requirements about protecting user privacy. This talk will examine the effectiveness of the current DPG standard for ensuring adequate privacy protections. We explain the DPG standard's current rubric, followed by a systematic assessment of responses from major DPGs regarding their protections of users' privacy. We will also present in-depth case studies from major DPGs to identify critical privacy threats. Our findings reveal serious limitations in the current evaluation approach. We will conclude by presenting preliminary recommendations and improvements to the DPG standard.