 Sweeney L, Crosas M, Bar-Sinai M. Sharing Sensitive Data with Confidence: The DataTags System. Technology

Science. 2015101601. October 16, 2015. http://techscience.org/a/2015101601; PDF version attached: [](techsci-datatags-sweeneycrosasbarsinai.pdf).

Related:
- [ISO 27001 A 8.2 Information classification](../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%208.2%20Information%20classification.md)
- [Privacy](../💡Drafts%20and%20Ideas/Privacy.md)

Sweeney at all have developed a privacy oriented data classification system with six levels:

![](Datatags%20classification.jpg)
*"Definitions for each of six datatags are introduced for demonstration purposes".*

The classification is based on a five level scheme designed and adopted by Harvard University for storing and transmitting research data.

The notion of datatags is introduced as a means of identifying handling and access requirements for a file.

Privacy risks associated with each level:
- Blue: zero risk for harm to individuals. This level is meant for non-confidential and non-personal information that can be stored and shared freely. 
- Green: meant for unidentifiable personal data. No risk currently, but in the future a re-identification vulnerability may develop.
- Orange: risk of material harm to individuals if disclosed.
- Red: serious harm to individuals if disclosed, including the risk of serious social, psychological, reputational, financial, legal or other harm to an individual or group.
- Crimson: non-authorized disclosure would cause severe harm to individuals


The proposed application is "a repository capable of handling sensitive and non-sensitive files in accordance with different security requirements".

A datatags-compliant repository satisfies the following conditions:

> 1.  A datatag is a set of security features and access requirements for file handling. A datatags repository has a finite, partially ordered set of datatags, where the strictness and strength of datatags’ security features and access requirements dictate the ordering. A repository must have more than one datatag.
>     
> 2.  All files in the repository must have a datatag, and each file in the repository has one and only one datatag. A file may optionally have additional handling requirements, such as an audit trail log or an expiration date. A file may optionally require additional terms for a data use agreement or additional terms of access by a recipient of the file from the repository. A file may have attributes that further describe it for reporting purposes. None of the optional requirements may weaken or replace the security requirements for the file’s assigned datatag, and none may adjust a datatag’s security requirements to be the same as another datatag or stronger than a more restrictive datatag.
>     
> 3.  A recipient who receives a file from the repository must satisfy the file’s associated access requirements, produce sufficient credentials as requested, and agree to any terms of use required to acquire a copy of the file.
>     
> 4.  Technological guarantees exist that the requirements in 1 and 2 are satisfied for all files in the repository and for all accesses to those files from the repository. This imposes auditing obligations on transactions in the repository.

