Privacy Starts by Design

By Sina Youn

A lot can happen to sensitive customer data in 287 days, the average time it takes from identifying a data breach to containing it. In between, the damage done and costs to cover it all can be astronomical, reaching upwards of $4m on average. And that’s just costs to the business, not the individuals whose privacy was violated.

While cost avoidance may not be the noblest reason to implement proactive data privacy protection, the reality is that expanding digital attack surfaces and increasing privacy regulations worldwide make the case for organizations to adopt privacy by design (PbD) principles very clear.

What is privacy by design?

Privacy by design (PbD) is a data protection concept that emphasizes building in the privacy of personal and sensitive information to any product, service, system, or process from the outset.

The practice of privacy by design is shaped by privacy by design (PbD) principles which act as a guide to reimagining everything from business operations to the development of new technology with data privacy at the foundation, instead of as an add-on or afterthought. As a human-centric set of principles, PbD provides a framework for a ‘privacy first’ approach that can be applied throughout an organization and embedded within business practices as well as products.

7 foundational principles of PbD

The concept of privacy by design was introduced by Ann Cavoukian, the former Information and Privacy Commissioner for the Canadian province of Ontario, in the 90’s. According to Ann, there are seven foundational principles of PbD:

1. Proactive not reactive; preventative not remedial: An ounce of prevention is worth a pound of cure. Don’t wait for privacy risks to appear - prevent them from occurring in the first place. For example, only collect data that is absolutely necessary.
2. Privacy as the default setting: Privacy must be the standard, not the option. Privacy by design means automatically protecting personal or sensitive data in the product, system, or process; no action is required by the individual to protect their privacy.
3. Privacy embedded into design: Privacy measures should not be add-ons, but fully integrated components of the product or system throughout the data lifecycle from collection and processing to data disposal.
4. Full functionality — positive-sum, not zero-sum: Privacy by design considers privacy to be additive rather than adversarial with other attributes of design such as security and usability.
5. End-to-end security — full lifecycle protection: End-to-end security works in concert with embedded privacy to secure every point in the data lifecycle from collection through disposal.
6. Visibility and transparency — keep it open: Create trust based on visibility and transparency to assure stakeholders that privacy practices are implemented as stated and can be independently verified.
7. Respect for user privacy — keep it user-centric: Privacy by design is founded on respect for the user and builds on a user-centric approach.

It’s important to note that PbD is not a government regulation or industry standard such as PCI-DSS for digital payments, however the concept is now incorporated within the regulatory understanding of privacy, for example Article 25 of the GDPR is titled “Data Protection by Design and by Default.” Additionally, there is no specific guide or technical implementation manual for PbD.

Rather, PbD is about making a privacy paradigm shift. With PbD at the foundation, organizations can not only avoid the damage and costs of data privacy breaches (hint: it’s a lot more expensive to re-engineer privacy into a product than to build it in from the get-go) and protect customer and user data, organizations also stand to gain privacy as a competitive advantage.

Examples of companies that have implemented privacy by design

Leading brands are racing to address the new privacy landscape, and many are adopting PbD principles as a means to create competitive advantage. Porsche for example announced a new privacy strategy aimed at giving customers full transparency and control over data processing inside their vehicles.

There are many high-profile examples of companies’ steps to address privacy needs with the design of their products or services. Apple is well known for its product design approach grounded in privacy by default, collecting only the minimum amount of data necessary to provide users with a product or service, and enabling users to control privacy settings.

WhatsApp provides an example of the increasing demand for privacy by consumers. Despite leading the messaging-app industry on privacy when they introduced end-to-end encryption in 2016, an update to their privacy policy to share some user data with their parent company Facebook caused millions of users to jump ship.

And even Google recognizes that enabling more privacy is unavoidable, whether due to consumer pressure or regulatory demands, and recently rolled out several new privacy control features.

The benefits of privacy by design for businesses and consumers

There are many benefits to adopting PbD for businesses that extend beyond avoiding the risks of taking a reactive, after-the-fact approach. Waiting until an incident occurs to address data privacy means incurring high containment costs and risking class-action lawsuits, brand reputation damage, and loss of customer confidence and trust.

On the other hand, bringing privacy into the design of products and processes helps to avoid such risks and offers value-creating benefits, including:

• Higher brand value: Including privacy at the core of company operations and products demonstrates respect for the customer that can establish greater emotional brand association.
• Increased trust and loyalty: Customers and users take privacy very seriously and will leave products that violate their trust. Putting privacy by design into practice can increase consumer trust in the business.
• Increased security: Privacy by design can help to prevent privacy breaches and protect the personal data of users.
• Improved user experience: When privacy is considered from the start of a project, it is more likely that privacy-enhancing features will be built into the final product or service.
• More innovation: Embracing a privacy-first mindset and finding new ways of enhancing privacy and security can inspire innovation and create growth.

Where and how can you apply privacy by design in your product or business?

As you evaluate products and business processes for implementing PbD, consider all types of data in the design of privacy protection. Assess the life cycle of all business data to understand what it contains and why.

Ideas for getting started applying privacy by design in business:

• Development: Train product managers and developers on Privacy by Design principles and best practices. Create a culture that embraces privacy protection.
• Business analytics: Implement data management practices to avoid redundant copies of data sets and ensure privacy best practices.
• Marketing: Communicate clearly about privacy policies and ensure privacy is the default setting across channels.
• Supply chain: Confirm privacy practices by external partners to ensure alignment with your standards.
• Legal: Establish data handling practices such as automated data redaction to ensure compliance with applicable regulations.

Keep in mind a few essentials for your implementation checklist:

1. Include privacy in the early stages of planning.
2. Think about the data you are collecting and ensure only necessary data is collected.
3. Consider the privacy implications of new features before adding them.

Stay ahead of the challenges to implementing privacy by design

Implementing privacy by design will likely require changes to processes and how your business operates. Be prepared to address the challenges of incorporating privacy by design:

• Change management: Effective communication with employees will be crucial as privacy protection may be new to decision making.
• Technical challenges: Actualizing privacy by design often entails new technical measures.
• Costs: Anticipate costs due to changes, training, and new technology for implementing privacy by design.

Bringing privacy by design (PbD) principles to life with AI for data protection

Bringing PbD principles to life with AI for data protection is becoming increasingly important as privacy regulations tighten. Privacy by design is bolstered by privacy-enhancing technologies (PETs) that leverage data's value without compromising privacy. Tools like document encryption and anonymization are crucial for businesses aiming to utilize data value without privacy concessions.

As a PET, super.AI introduces no-code AI solutions for document redaction through its Intelligent Document Processing (IDP) platform. This platform merges advanced AI models with human expertise to offer unparalleled detection accuracy and near-perfect anonymization quality, ensuring compliance with privacy laws.