From Theory to Practice of Data Minimization

[Inria Saclay ou visio via inria.webex.com/meet/benjamin.nguyen] Séminaire organisé par Andrei Sabelfeld (Chalmers University of Technology) le 17/11/2025.

Attention : Séminaire SDS

Résumé :

The principle of data minimization is foundational to privacy and security, yet putting it into practice remains a significant challenge. This talk develops language-based data minimization and demonstrates how to enforce it in practice across modern data-driven systems. We explore how the semantics of user-defined automation logic can be analyzed to derive minimal data-access requirements. We leverage program dependency analysis and deferred computation to enforce data-access minimization in some cases even in adversarial environments, without requiring trust in the execution platform. Our approach spans both static and dynamic enforcement techniques and accommodates features such as queries and nondeterminism. We showcase its effectiveness for Trigger-Action Platforms (TAPs) through the development and empirical evaluation of tools such as minTAP and LazyTAP.