“Mapping the Privacy Landscape for Central Bank Digital Currencies”
Communications of the ACM, March 2023, Vol. 66 No. 3, Pages 46-53
Practice
By Raphael Auer, Rainer Böhme, Jeremy Clark, Didem Demirag
“While there are exceptions, the gap in concrete privacy solutions in policy reports is puzzling, as economists have argued that CBDC could make an essential difference in providing privacy in digital payments.”
Payment records paint a detailed picture of an individual’s behavior. They reveal wealth, health, and interests, but individuals do not want the burden of deciding which are sensitive or private.1 Central banks are exploring options to digitize cash. As of January 2023, 27 of the 38 member states of the Organization for Economic Cooperation and Development (OECD) have announced retail central bank digital currency (CBDC) research and projects.
The issue of privacy needs to move center stage. Decades of work on privacy-enhancing technologies have highlighted that privacy does not come for free, it is easy to get wrong, and it is imperative to design before deployment.
CBDC has been discussed in policy reports, academic papers, and public media through lenses such as monetary policy, impact on the financial system, and technology. Almost all of these documents flag the importance of privacy, but many lack in-depth discussion or concrete design choices. Figure 1 shows the uptake of privacy in the CBDC literature: While the question is raised, significant treatment is still rare. An exception is recent academic papers (shown in the top right corner of the figure), which are generally written by computer scientists. These papers offer specific solutions to include in the privacy design landscape.
Policymakers may shy away from papers with cryptographic equations that mention Alice and Bob. While there are exceptions, the gap in concrete privacy solutions in policy reports is puzzling, as economists have argued that CBDC could make an essential difference in providing privacy in digital payments. It is popular for authors of these reports to point out the tension between privacy and law enforcement; reiterate that it requires a solution; and ultimately punt to government officials, legislators, the judiciary, or public opinion to solve it. Occasionally, technical solutions are prescribed (for example, blockchains, cryptography, zero-knowledge proofs) without adequate operational details or even precision about exactly what data is protected from whom. The number of distinct stakeholders, combined with the technical challenges, has stalled progress toward deploying retail CBDC.
One step forward is understanding who the key stakeholders are and what their interests are in payment records. Knowledge of conflicting interests is helpful for developing requirements and narrowing the range of technical solutions. This article contributes to the literature by identifying three stakeholder groups—privacy-conscious users, data holders, and law enforcement—and exploring their conflicts at a high level.
A main insight is that nuanced data-access policies are best to resolve the conflicts, which in turn rule out many technical solutions that promise “hard privacy,” meaning solutions relying on cryptography and user-guarded secrets without room for human discretion. This observation shifts attention to a softer form of privacy-enhancing technologies, which gives authorized stakeholders the capability to access certain payment records in plaintext under defined circumstances. Such a system depends on compliance and accountability, supported with technically enforced access control, limited retention periods, and audits. This is referred to as “soft privacy.”
About the Authors:
Raphael Auer is head of the Eurosystem Centre of the BIS Innovation Hub, which has offices in Frankfurt and Paris and explores technologies to improve the functioning of the global financial system.
Rainer Böhme is a professor of computer science at the University of Innsbruck, Austria, where he focuses on solving societal problems of technology policy, security, and privacy.
Jeremy Clark is an associate professor at the Concordia Institute for Information Systems Engineering in Montreal, Canada, where he holds the NSERC/Raymond Chabot Grant Thornton/Catallaxy Industrial Research Chair in Blockchain Technologies.
Didem Demirag is a postdoctoral researcher at the University of Quebec in Montreal, Canada.
