Data encryption: the delicate balance of the privacy-security trade-off

• Author: María Dolores García Sánchez
• Profession: PAIDI Predoctoral Contract Lecturer. University of Seville
• Pages: 199-221

199

Data encryption: the delicate balance

of the privacy-security trade-off 1

M D G S

PAIDI Predoctoral Contract Lecturer. University of Seville

1. PREVIOUS CONSIDERATIONS: THE PRIVACY AND SECURITY

DUALITY

In the current world, encryption technology is increasingly being used in all

areas of public and private life. It serves as a means of protecting individuals, civil

society, critical infrastructure, media, industry and governments, ensuring privacy,

confidentiality, information integrity, and the availability of communications and

personal data.

Data encryption involves a process that employs a mathematical algorithm

capable of transforming the characters of standard text into an unreadable format

(ciphered text). It utilizes encryption keys to scramble the data - a process known

as cryptography - so that only authorized users with the key can read it.

Essentially, there are two main types of encryption: symmetric encryption

and asymmetric encryption. The difference is that in symmetric encryption, also

known as single-key encryption, the same key is used to both encrypt and decrypt

the message, which must be known in advance by the sender and the recipient.

On the other hand, asymmetric encryption relies on the use of two keys:

a public key, which is available to anyone needing to encrypt information and

is not used for the decryption process, and a private key that enables message

decryption. 2

1 This article is carried out with the support of the Pre-doctoral Researcher Training Contract

Grant from the Junta de Andalucía and within the framework of the research project “Biomedicine,

Artificial Intelligence, Robotics, and Law: Challenges for Legal Professionals in the Digital Era (PID2019-

1081555RB-I00).

2 INCIBE (June 24, 2019), ¿Sabías que existen distintos tipos de cifrado para proteger la privacidad de

nuestra información en Internet?. https://www.incibe.es/ciudadania/blog/sabias-que-existen-distintos-tipos-

de-cifrado-para-proteger-la-privacidad

María Dolores García Sánchez

200

Within these asymmetric encryption methods is where end-to-end encryption is

integrated. In many online services, data storage is entrusted to external providers.

To ensure compliance with data protection requirements, both legal 3 and technical

safeguards are established, including data encryption 4. Due to its greater ability

to ensure the privacy of information transmitted between users -compared to

symmetric encryption and other types of asymmetric encryption-, end-to-end

encryption is predominantly used by instant messaging companies (WhatsApp,

Telegram or Skype), protecting communications from one endpoint to another 5.

In fact, in this companies it has been implemented by default to reinforce

the protection of privacy and confidentiality of communications, particularly

regarding international data transfers.

In the specific case of WhatsApp, the application informs us about the use

of this encryption through a default message every time we start a conversation

or open the app on a computer: “Messages are end-to-end encrypted. No one

outside this chat, not even WhatsApp, can read or listen to them.” The application

has been using this end-to-end encryption protocol since March 31, 2016.

The natural question that arises is: What does this end-to-end information

encryption technology entails?

As indicated in the quoted message, it prevents third parties, including

WhatsApp, from having full access to the messages or calls exchanged between

two communicating parties. Moreover, if the encryption keys of a user’s device are

3 Specifically in Chapter IV of the General Data Protection Regulation (GDPR), which sets out the

relationship between the data controller and the data processor.

4 Enabled by the GDPR itself as a guarantee to preser ve security in the processing of personal data

(arts. 6 and 32).

5 There is a step further in this encryption: homomorphic encryption, which not only protects data

transmission but also provides the ability to process data without decrypting it. This means that actions

like additions, multiplications, and other operations can be performed on encrypted data, and encrypted

results can be obtained, which can later be decrypted to obtain the result of the original operation. In other

words, it enables performing computations on encrypted data without revealing its original content and,

therefore, without compromising privacy.

Now, if homomorphic encryption is even more powerful from a privacy perspective, why isn’t it

employed by instant messaging services? The reason lies in the fact that while it is a very powerful cryptographic

technique, it is also computationally demanding. This significant amount of processing power and time could

negatively impact the user experience in instant messaging applications, where speed and responsiveness

are paramount. Additionally, this type of encryption generally increases the size of the encrypted message

compared to the original, which can have a negative impact on bandwidth, storage, and data transmission

speed.

Furthermore, it requires both the sender and receiver to be compatible with the same homomorphic

cryptographic scheme, which can be a challenge in the instant messaging environment, where users may

employ a variety of different applications and platforms. Achieving interoperability between heterogeneous

systems using homomorphic encryption can be complex and limit its widespread adoption.

However, these limitations are becoming increasingly less significant due to technological

advancements and the increase in system power, so it wouldn’t be surprising if, in the near future,

homomorphic encryption may begin to be incorporated into such applications as it would allow for

handling and processing of user data without compromising their privacy.