Working with data protection can be quite overwhelming and confusing. Since the introduction of the GDPR, things got even more complex. In this blog post, I discuss a way of thinking that might make it a bit easier to coordinate your efforts around privacy, data protection and the GDPR, called Privacy by Design. After reading this, you should have a general idea of what Privacy by Design means, how it relates to the 7 principles of the GDPR, and how it can help even the smallest businesses elevate their privacy and data protection.
Table of contents
- What is Privacy by Design?
- Why should we care about Privacy by Design?
- Privacy by Design in the GDPR
- Getting Started with privacy by design
- The 7 Foundational Principles of Privacy by Design
- Concrete actions: How to implement Privacy by Design
- Formalised management commitment to privacy and data protection
-
Appointing a team or person responsible for privacy and data protection
-
Providing customers with a one-stop privacy portal
-
Clearly communicating and documenting your reasons and justifications for collecting data
-
Avoiding dark patterns
-
Ensuring that your team handles data correctly and securely
-
Fostering closer collaboration between data protection teams and business teams
-
Data protection impact assessments (DPIA)
-
Frequent monitoring of privacy and data risks
-
Your team is equally important in achieving strong Privacy by Design
-
Using awareness training for Privacy by Design
- In Conclusion
What is Privacy by Design?
Privacy by Design was at first only used in software and systems development. There, Privacy by Design means that privacy measures are built into the design of systems. This way, privacy and data protection are core functionalities of the system, in addition to what the system was designed to do in the first place.
We can easily translate this from software development to a broader context, like your business. For your business, it means that for any new process or activity, data protection and privacy should be considered from the very early planning stages. In other words, Privacy by Design means thinking of privacy when designing new processes.
The idea is that protecting the data and privacy of your customers should be a goal you always strive towards equally as much as your business goals. By employing Privacy by Design, the data and privacy of your customers are always protected and the control over this data always remains with the customer, who can withdraw consent at any time.
Designing your systems and processes in this way might seem unnecessary at first, but it brings many advantages. Contrary to what the name implies, you can work towards Privacy by Design in your business with small steps and experience the benefits rather quickly. It’s not necessary to radically overhaul everything you do at once!
Some benefits of Privacy by Design include:
-
It simply makes data protection in your organisation stronger and thus data breaches less likely. Data breaches can lead to great monetary losses.
-
You show your customers that you are conscious about using data ethically, and that you value and care about their privacy. This will help you create trusting relationships.
-
It is a good way to future-proof your business. We can almost certainly expect regulatory, but also consumer pressure for strong privacy controls to increase in the future. Starting right now with designing your business to be privacy-aware prevents you from being forced to implement more radical and costly changes in the future when the timing may not be optimal.
-
Cyber security threats change constantly and fast. By building a strong data protection foundation into your systems and processes, you minimise the time and resources you need to spend on reacting to ever-changing data and privacy risks.
-
Privacy by Design is part of the GDPR and thus implementing Privacy by Design can be a great help towards complying with the GDPR.
Based on the concept of Privacy by Design, Article 25 of the GDPR introduces “data protection by design” and “data protection by default”. Below, I explain both concepts with short excerpts from Article 25.
Data protection by default is described as:
-
“By default, only personal data which are necessary for each specific purpose of the processing are processed”
-
“By default, personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons”
In other words: organisations should minimise data collection to the strictly necessary data that is needed to fulfil their purpose. If a user takes no action, their data should still be protected, their privacy still guaranteed.
Privacy by Design example – cookie noticeImagine the usual cookie notice. Many of us ignore it or simply click it away as fast as possible. If data protection is the default, this should mean that only the strictly necessary cookies are active. A user taking no action means that the default situation (maximum data protection) should not be changed. More cookies should only be activated when the user explicitly consents to them. However, some websites automatically activate all cookies. Clicking away the cookie notice means accepting all third-party cookies. This is not data protection by default. |
Article 25 of the GDPR describes data protection by design as “integrating the necessary safeguards into the processing”. In other words, any data protection measures and safeguards must be baked into the data processing system by design.
Data protection by design and by default are legal obligations under the GDPR. Failing to implement them means violating the GDPR. However, right now we can observe that Privacy by Design is not among the usual breaches of the GDPR, indicating that Privacy by Design is not strictly enforced.
This does not mean that you should not care though. As previously said, working on Privacy by Design brings many advantages to your business, and your local data protection authorities could always decide to start enforcing it more strictly. So how do you get started with Privacy by Design?
Unfortunately, Article 25 is quite brief, and beyond “appropriate technical and organisational measures” and two examples (pseudonymisation and data minimisation), it doesn’t offer much guidance on what exactly “appropriate measures” would be.
Luckily, any measures you already have towards improving your data protection are likely also contributing to privacy by design. We also already underlined that taking small steps towards Privacy by Design is perfectly reasonable and the best way forward for most businesses, so there’s no reason to get discouraged or intimidated.
We have tried to shed light on what “appropriate measures” could be by looking at previously issued GDPR fines.
For more concrete guidance, we can look back to the original concept of Privacy by Design. It was first put into writing in 2009 by Ann Cavoukian, then the Information & Privacy Commissioner of Ontario, Canada. She developed the 7 Foundational Principles of Privacy by Design.
The 7 principles are:
-
Proactive not Reactive; Preventative not Remedial
-
Privacy as the Default Setting
-
Privacy Embedded into Design
-
Full Functionality – Positive-Sum, not Zero-Sum
-
End-to-End Security – Full Lifecycle Protection
-
Visibility and Transparency – Keep it Open
-
Respect for User Privacy – Keep it User-Centric
We’ll discuss each of them briefly below, each time connecting them with some first steps towards “appropriate technical and organisational measures” as Privacy by Design examples.
The first of the 7 principles of Privacy by Design sets out the general mindset you should maintain throughout all the principles. Data protection and privacy should come up at the beginning of the planning process for any new initiatives in your business.
You should always aim to prevent privacy problems and data breaches, rather than react to them as they happen.
One way of doing this is performing a periodic risk analysis where you identify potential privacy and data risks and their impacts on your business. You can then take data protection measures before any negative impacts happen, essentially preventing them.
We developed a useful risk analysis template that can help you to get started with proactively identifying risks in your organisation.
Any IT system or process in your organisation must be designed so that privacy and data are automatically protected. If an individual customer takes no action, the minimal amount of data should be collected on them, and their privacy should remain protected (think back to the cookie notice example).
Simply put, the default state in your business should be collecting no data whatsoever. However, we all know that it would be very hard to run your business then. Some data collection is therefore justified, as long as it has a clear purpose.
You should carefully consider what kinds of data you need to meet your business goals. When collecting this data, make sure to:
- Have legal grounds for any data you collect
-
Only collect data you need. Any other data collection should be strictly opt-in
-
Delete the data you no longer use or need
A handy guideline to follow here is data minimisation.
What this principle of Privacy by Design is saying is that privacy and security should be just as important as whatever business goals you are trying to achieve when designing new processes or activities.
Another way to think about this is to view a discovered security vulnerability in the same way as a design flaw. You wouldn’t simply patch a design flaw that compromises your bottom line. As a result, when thinking of data protection as something that’s equally important as your bottom line, you also wouldn’t simply patch a security vulnerability. You should go back to the drawing board and design your process or system so that such a vulnerability is not possible in the first place.
This relates to what we discussed above: privacy and security should be just as important as your business goals. This means that it makes no sense to add-on security measures after designing a new process. This would make security feel more like an afterthought. The result is that the security measures can be quite annoying, and that people might try to work around them because it would be more efficient than complying.
This principle tries to prevent that. The point here is that privacy should not be something that takes away from other objectives, like efficiency or functionality.
By working with privacy and security from the start, the idea is that such false dilemmas can be overcome to create a win-win situation: privacy and efficiency, privacy and functionality.
How can you do this concretely though? The idea would be that the person or team responsible for data protection is more closely involved in design activities so that they can more easily align with the business goals of a system or process.
So instead of designing a workflow and then handing it off to, for example, your Data Protection Officer to check if it is secure enough, try working more collaboratively with someone from IT from the start.
This principle of Privacy by Design again explicitly covers some things we already know. Data protection measures are implemented proactively before the first piece of information is collected, and are maintained throughout the entire data lifecycle, until the data is timely and securely destroyed at the end of the process.
Data lifecycle?When working with (personal) data, it is often a good idea to think in terms of data lifecycle management. In short, this enables you to consider how your data is used throughout the different phases of its “life”, including data creation, storage, processing, archival, and destruction. |
What this basically means is that data protection should be the default at every stage of the lifecycle. So, for instance, security measures like encryption, authentication, logging, etc., should be used at every stage.
Taking this together with the previous principles, it means that:
-
Only strictly necessary data is collected, each time with a clearly communicated purpose.
-
The data is kept for the strictly minimal amount of time needed to fulfil the purpose.
-
The data is stored and processed securely through e.g., encryption, strong access control, and logging methods.
-
The data is securely destroyed as soon as it is no longer necessary to fulfil the purpose.
This principle of Privacy by Design is quite straightforward. You should be open and transparent to the people you collect data from, including what data is collected, for what purposes, how it is processed, and how protection is ensured. People should also be clearly informed about their rights and possibilities to ask questions, file complaints, or have their data deleted.
Essentially, this boils down to having a clear and understandable privacy policy that your customers can easily refer to when in doubt.
This last principle is here just to remind us of the main thing we are trying to do here: treating our customers’ data and privacy with respect.
Therefore, it is a good idea to always try to keep the interest of the individual user in mind when designing your systems and practices for data processing. Design them in a clear, user-friendly way that provides users with strong privacy defaults, appropriate notice, and a clear overview of their collected data.
In short, designing your systems and practices in such a way to empower users to actively manage their own data, or at least be aware of their data.
It also means knowing that the user always remains the owner of their data. In the end, your business is just borrowing your customers’ data. They should be able to withdraw their consent for this at any time.
This comes back to what we discussed earlier: show your customers that you understand the value of their privacy and that you take care to use their data responsibly. Show them they can trust you.
I hope you now have a deeper understanding of what Privacy by Design and data protection by design and default are trying to achieve, and why it is a good idea to gradually start using this way of thinking in your business too.
Now let’s explore some of those “appropriate technical and organisational measures” that can be used to implement the Privacy by Design principles in practice. We have already discussed a few; for example, periodically conducting a risk analysis, practicing data minimisation, and writing a clear privacy policy.
Keep in mind here that no one expects you to be a Privacy by Design expert from the start. It should be clear now that a lot can be achieved through relatively small steps and actions. So even just working with one or a few of the measures below can contribute a lot to privacy protection in your business. There are of course also many more actions than just the ones we discuss here.
More explicitly involving privacy and data protection in e.g., your organisation’s mission statement, values, and internal policies. Formalising this commitment is the first step towards living it. One part of this is writing a clear information security policy and acceptable use policy. We have developed guides and templates for both.
This could, for example, be a data protection officer (DPO). It is then also important to clearly communicate who this is and how they can be contacted, both to your staff and to your customers and partners.
Providing customers with an easy-to-find place where they can manage all their privacy and data controls, in a clear and user-friendly way. Too often, privacy and data settings can be quite hard to find or are spread out in different settings menus.
Being transparent in your data collection and processing means that for each piece of information that you collect, you should clearly document and communicate your purpose and legal grounds, and by which people or processes the data will be processed. Not sure where to start? We have a guide to the roles of data processers and controllers.
User-centric and user-friendly design also means avoiding dark patterns. E.g., your cookie notice should have a clearly marked ‘decline’ option that is equal to the ‘accept’ option. You should not be manipulating people into handing over more data than they would willingly consent to.
Implementing measures to prevent your staff from using the data for anything else than the documented purpose, or from not following data protection guidelines. These could include training in practices like data minimisation, pseudonymisation, and anonymisation; or technical security measures like access controls, encryption, and logging methods.
The idea is that both data protection and business goals can be achieved without one negatively impacting the other. This can be achieved by encouraging both teams to work together from the start of projects and ensuring that they get equal input.
Performing data protection impact assessments (DPIA) for major processes and projects. Again, it’s important to involve multiple perspectives here so that the DPIA does not prevent achieving business goals.
Monitoring privacy and cyber security risks in your processes and activities frequently, and for all stages in the data lifecycle: collection, storage, processing, and destruction. Threats to privacy and data change constantly. It’s important that you set up a framework where, e.g., the risk analysis is performed periodically.
Your team is equally important in achieving strong Privacy by Design
Implementing data protection by design and default through these 7 principles of Privacy by Design naturally involves quite a bit of technical measures in your IT systems and architecture. However, as you’ve probably noticed, an organisation’s business practices and processes themselves are equally important in ensuring that privacy remains the default throughout the data lifecycle.
But then, it is your team who is probably the most important in ensuring strong data protection. Your team needs to be aware of what personal data is, what common data protection risks are, what the general rules concerning handling personal data are, and so on.
Your team needs this awareness and knowledge so that they can understand why your business processes and systems are designed in this Privacy by Design way. So that they understand, for example, why they can only store customer data in the designated system or location, and not in their own undisclosed spreadsheets.
In short: staff awareness is a big part of data protection by design and default. Unaware staff will undoubtedly process data in ways that might not be optimal for privacy.
A good way to get your staff to think in a user-centric, privacy-first way, is to conduct security awareness training. We discussed staff training previously as one of the concrete actions contributing to Privacy by Design.
Awareness training is designed for exactly this purpose: making people aware of risks, rules, procedures, and more.
Take for instance the first Privacy by Design principle: proactive not reactive; preventative not remedial. Proactively identifying risks and developing appropriate measures and safeguards also involves making your staff aware of these risks and training them in how to respond to them.
Similarly, security vulnerabilities are often thought of as technical issues, but a lack of awareness that leads to a team member clicking a phishing link is just as much of a security vulnerability.
We’ve put together 11 tips for getting started with awareness training. You’ll see that it’s easier than you might think!
While the GDPR’s reasoning and guidance for data protection by design and default is brief and quite vague, it is not difficult to see how these concepts are easily in line with what the GDPR is trying to achieve overall: giving individual users more control over their data.
Using the Privacy by Design principles in your organisation not only brings you well on your way to complying with the GDPR, but it also helps in building a trusting and open relationship with your customers and partners. And where’s the harm in that?
