JMIR Publications

ABSTRACT

The collection, storage and analysis of large datasets is relevant in many sectors. However, it is strictly regulated, such as by the General Data Protection Regulation (GDPR). These regulations mandate strict data security and data protection and thus create major challenges for collecting and utilizing large datasets. Technologies like Federated Learning (FL), especially paired with Differential Privacy (DP) and Secure Multiparty Computation (SMPC) aim to solve these challenges. In this scoping review, we summarize the current discussion on the legal questions and concerns relating to Federated Learning systems. We are particularly interested in whether and to what extent FL applications and training processes are compliant with the GDPR data protection law and whether the use of the aforementioned privacy-enhancing technologies (DP, SMPC) affects this legal compliance. We identified and summarized the findings of 56 relevant publications on FL, revealing that a combination of FL with SMPC and DP is necessary to fulfill the legal requirements for systems dealing with personal data.