Privacy by design

The privacy by design framework was developed by Ann Cavoukian, Information and Privacy Commissioner of Ontario, following her joint work with the Dutch Data Protection Authority and the Netherlands Organisation for Applied Scientific Research in 1995.[1][10] In 2009, the Information and Privacy Commissioner of Ontario co-hosted an event, Privacy by Design: The Definitive Workshop, with the Israeli Law, Information and Technology Authority at the 31st International Conference of Data Protection and Privacy Commissioner (2009).[11][12]

In 2010 the framework achieved international acceptance when the International Assembly of Privacy Commissioners and Data Protection Authorities unanimously passed a resolution on privacy by design[13] recognising it as an international standard at their annual conference.[12][14][15][4] Among other commitments, the commissioners resolved to promote privacy by design as widely as possible and foster the incorporation of the principle into policy and legislation.[4]

Germany released a statute (§ 3 Sec. 4 Teledienstedatenschutzgesetz [Teleservices Data Protection Act]) back in July 1997.[16] The new EU General Data Protection Regulation (GDPR) includes ‘data protection by design’ and ‘data protection by default’,[17][18][10] the second foundational principle of privacy by design. Canada’s Privacy Commissioner included privacy by design in its report on Privacy, Trust and Innovation – Building Canada’s Digital Advantage.[19][20] In 2012, U.S. Federal Trade Commission (FTC) recognized privacy by design as one of its three recommended practices for protecting online privacy in its report entitled Protecting Consumer Privacy in an Era of Rapid Change,[21] and the FTC included privacy by design as one of the key pillars in its Final Commissioner Report on Protecting Consumer Privacy.[22] In Australia, the Commissioner for Privacy and Data Protection for the State of Victoria (CPDP) has formally adopted privacy by design as a core policy to underpin information privacy management in the Victorian public sector.[23] The UK Information Commissioner’s Office website highlights privacy by design[24] and data protection by design and default.[25] In October 2014, the Mauritius Declaration on the Internet of Things was made at the 36th International Conference of Data Protection and Privacy Commissioners and included privacy by design and default.[26] The Privacy Commissioner for Personal Data, Hong Kong held an educational conference on the importance of privacy by design.[27][28]

In the private sector, Sidewalk Toronto commits to privacy by design principles;[29] Brendon Lynch, Chief Privacy Officer at Microsoft, wrote an article called Privacy by Design at Microsoft;[30] whilst Deloitte relates certifiably trustworthy to privacy by design.[31]

Privacy by design is based on seven "foundational principles":[3][32][33][34]

1. Proactive not reactive; preventive not remedial[3][32][33][34]
2. Privacy as the default setting[3][32][33][34]
3. Privacy embedded into design[3][32][33][34]
4. Full functionality – positive-sum, not zero-sum[3][32][33][34]
5. End-to-end security – full lifecycle protection[3][32][33][34]
6. Visibility and transparency – keep it open[3][32][33][34]
7. Respect for user privacy – keep it user-centric[3][32][33][34]

The principles have been cited in over five hundred articles[35] referring to the Privacy by Design in Law, Policy and Practice white paper by Ann Cavoukian.[36]

The International Organization for Standardization (ISO) approved the Committee on Consumer Policy (COPOLCO) proposal for a new ISO standard: Consumer Protection: Privacy by Design for Consumer Goods and Services (ISO/PC317).[37] The standard will aim to specify the design process to provide consumer goods and services that meet consumers’ domestic processing privacy needs as well as the personal privacy requirements of data protection. The standard has the UK as secretariat with thirteen participating members[38] and twenty observing members.[38]

The Standards Council of Canada (SCC) is one of the participating members and has established a mirror Canadian committee to ISO/PC317.[39]

The OASIS Privacy by Design Documentation for Software Engineers (PbD-SE)[40] Technical Committee provides a specification to operationalize privacy by design in the context of software engineering. Privacy by design, like security by design, is a normal part of the software development process and a risk reduction strategy for software engineers. The PbD-SE specification translates the PbD principles to conformance requirements within software engineering tasks and helps software development teams to produce artifacts as evidence of PbD principle adherence. Following the specification facilitates the documentation of privacy requirements from software conception to retirement, thereby providing a plan around adherence to privacy by design principles, and other guidance to privacy best practices, such as NIST’s 800-53 Appendix J (NIST SP 800-53) and the Fair Information Practice Principles (FIPPs) (PMRM-1.0).[40]

Privacy by design originated from privacy-enhancing technologies (PETs) in a joint 1995 report by Ann Cavoukian and John Borking.[1] In 2007 the European Commission provided a memo on PETs.[41] In 2008 the British Information Commissioner's Office commissioned a report titled Privacy by Design – An Overview of Privacy Enhancing Technologies.[42]

There are many facets to privacy by design, including software and systems engineering[43] as well as administrative elements (e.g. legal, policy, procedural), other organizational controls, and operating contexts. Privacy by design evolved from early efforts to express fair information practice principles directly into the design and operation of information and communications technologies.[44] In his publication Privacy by Design: Delivering the Promises[2] Peter Hustinx acknowledges the key role played by Ann Cavoukian and John Borking, then Deputy Privacy Commissioners, in the joint 1995 publication Privacy-Enhancing Technologies: The Path to Anonymity.[1] This 1995 report focussed on exploring technologies that permit transactions to be conducted anonymously.

Privacy-enhancing technologies allow online users to protect the privacy of their personally identifiable information (PII) provided to (and handled by) services or applications. Privacy by design evolved to consider the broader systems and processes in which PETs were embedded and operated. The U.S. Center for Democracy & Technology (CDT) in The Role of Privacy by Design in Protecting Consumer Privacy[45] distinguishes PET from privacy by design noting that “PETs are most useful for users who already understand online privacy risks. They are essential user empowerment tools, but they form only a single piece of a broader framework that should be considered when discussing how technology can be used in the service of protecting privacy.”[45]

The privacy by design framework attracted academic debate, particularly following the 2010 International Data Commissioners resolution, these provide criticism of privacy by design with suggestions by legal and engineering experts to better understand how to apply the framework into various contexts.[7][9][8]

Privacy by design has been critiqued as "vague"[7] and leaving "many open questions about their application when engineering systems".[9]

In 2007, researchers at K.U. Leuven published Engineering Privacy by Design noting that “The design and implementation of privacy requirements in systems is a difficult problem and requires translation of complex social, legal and ethical concerns into systems requirements”. The authors claim that their statement regarding that the principles of privacy by design "remain vague and leave many open questions about their application when engineering systems", may be viewed as criticism. However, the purpose of the paper is to propose that "starting from data minimization is a necessary and foundational first step to engineer systems in line with the principles of privacy by design". The objective of their paper is to provide an "initial inquiry into the practice of privacy by design from an engineering perspective in order to contribute to the closing of the gap between policymakers’ and engineers’ understanding of privacy by design".[9]

It has also been pointed out that privacy by design is similar to voluntary compliance schemes in industries impacting the environment, and thus lacks the teeth necessary to be effective, and may differ per company. In addition, the evolutionary approach currently taken to the development of the concept will come at the cost of privacy infringements because evolution implies also letting unfit phenotypes (privacy-invading products) live until they are proven unfit.[7] Some critics have pointed out that certain business models are built around customer surveillance and data manipulation and therefore voluntary compliance is unlikely.[8]

In 2011, the Danish National It and Telecom Agency published as a discussion paper on "New Digital Security Models" the publication references "Privacy by Design" as a key goal in creating a security model that is compliant with "Privacy by Design". This is done by extending the concept to "Security by Design" with an objective of balancing anonymity and surveillance by eliminating identification as much as possible.[46]

In 2013, Rubenstein and Good used Google and Facebook privacy incidents to conduct a counterfactual analysis in order to identify lessons learned of value for regulators when recommending privacy by design. The first was that “more detailed principles and specific examples” would be more helpful to companies. The second is that “usability is just as important as engineering principles and practices”. The third is that there needs to be more work on “refining and elaborating on design principles–both in privacy engineering and usability design”. including efforts to define international privacy standards. The final lesson learned is that “regulators must do more than merely recommend the adoption and implementation of privacy by design”.[8]

Another criticism is that current definitions of privacy by design do not address the methodological aspect of systems engineering, such as using decent system engineering methods, e.g. those which cover the complete system and data life cycle. The concept also does not focus on the role of the actual data holder but on that of the system designer. This role is not known in privacy law, so the concept of privacy by design is not based on law. This, in turn, undermines the trust by data subjects, data holders and policy-makers.[7]

The advent of GDPR with its maximum fine of 4% of global turnover now provides a balance between business benefit and turnover and addresses the voluntary compliance criticism and requirement from Rubenstein and Good that “regulators must do more than merely recommend the adoption and implementation of privacy by design”.[8] Rubenstein and Good also highlighted that privacy by design could result in applications that exemplified Privacy by Design and their work was well received.[47][8]

The May 2018 European Data Protection Supervisor Giovanni Buttarelli's paper Preliminary Opinion on Privacy by Design states, "While privacy by design has made significant progress in legal, technological and conceptual development, it is still far from unfolding its full potential for the protection of the fundamental rights of individuals. The following sections of this opinion provide an overview of relevant developments and recommend further efforts".[10]

The executive summary makes the following recommendations to EU institutions:

• To ensure strong privacy protection, including privacy by design, in the ePrivacy Regulation,
• To support privacy in all legal frameworks which influence the design of technology, increasing incentives and substantiating obligations, including appropriate liability rules,
• To foster the roll-out and adoption of privacy by design approaches and PETs in the EU and at the member states’ level through appropriate implementing measures and policy initiatives,
• To ensure competence and resources for research and analysis on privacy engineering and privacy-enhancing technologies at EU level, by ENISA or other entities,
• To support the development of new practices and business models through the research and technology development instruments of the EU,
• To support EU and national public administrations to integrate appropriate privacy by design requirements in public procurement,
• To support an inventory and observatory of the “state of the art” of privacy engineering and PETs and their advancement.

The EDPS will:

• Continue to promote privacy by design, where appropriate in cooperation with other data protection authorities in the European Data Protection Board (EDPB),
• Support coordinated and effective enforcement of Article 25 of the GDPR and related provisions,
• Provide guidance to controllers on the appropriate implementation of the principle laid down in the legal base, and
• Together with data protection authorities of Austria, Ireland and Schleswig-Holstein, award privacy friendly apps in the mobile health domain.[10]

The European Data Protection Supervisor Giovanni Buttarelli set out the requirement to implement privacy by design in his article.[48] The European Union Agency for Network and Information Security (ENISA) provided a detailed report Privacy and Data Protection by Design – From Policy to Engineering on implementation.[49] The Summer School on real-world crypto and privacy provided a tutorial on "Engineering Privacy by Design".[50] The OWASP Top 10 Privacy Risks Project for web applications that gives hints on how to implement privacy by design in practice. The OASIS Privacy by Design Documentation for Software Engineers (PbD-SE)[40] offers a privacy extension/complement to OMG’s Unified Modeling Language (UML) and serves as a complement to OASIS’ eXtensible Access Control Mark-up Language (XACML) and Privacy Management Reference Model (PMRM). Privacy by Design guidelines are developed to operationalise some of the high-level privacy-preserving ideas into more granular actionable advice.[51][52]

• Consumer privacy
• General Data Protection Regulation
• FTC fair information practice
• Internet privacy
  • Mesh networking
  • Dark web
  • End-to-end encryption
• Personal data service
• Privacy engineering
• Privacy-enhancing technologies
• Surveillance capitalism
• User interface design