.png)
Now, anyone who knows me, knows I love talking about GDPR, Cybersecurity, Information Security and a whole host of topics… Heck! I just love talking! 🤣
But one of the things I also do, is bringing these topics to life with analogies and metaphors. So let me give it a go with a set of principles that few have heard of, and many haven’t
Privacy By Design
The analogy I’m going to use here is one of sailing and sailing ships. Why? Well, why not?! It works… so let’s get on board with a ship called ‘Privacy by Design’ and set sail across the ocean of Data Protection and see where we get to!
Firstly, it’s important to know that ‘Privacy by Design’ is a concept that has 7 key principles. These principles are the thing which will help us navigate stormy seas, to our ultimate destination of business nirvana.
So let’s take a look at each of the principles in turn.
1. Proactive not Reactive; Preventative not Remedial
This principle takes a proactive approach to privacy, by aiming to prevent privacy violations from happening in the first place. This is in contrast to a reactive approach, which only addresses privacy issues after they have occurred.
Imagine your business is a swanky new ship, and you’ve equipped it with state-of-the-art leak detectors, because instead of waiting for a breach, you decided to be proactive and consider the risks to the thing that’s going to keep you afloat. Privacy by Design prompts you to patch up potential cracks in your data vessel before they even appear. Take, for instance, customer consent. Instead of drowning them in a sea of legalese, you should ask for permissions in plain, understandable language.
2. Privacy as the Default Setting
Privacy should be a ‘default’ setting for all your designs, meaning that users should not have to take any action to protect their privacy.
For example, imagine you've just boarded your ship, and the pilot asks if you'd like your lifebelt to float. Ridiculous, right? In the world of Privacy by Design, data protection is the default setting. It means safeguarding information without your customers having to jump through hoops and ‘tick’ extra boxes or choose additional settings.
3. Privacy Embedded into Design
Privacy should be considered and embedded into every step of the design and development of products and services; from the initial concept to the final product.
This means that privacy should not be an afterthought.
Before you’ve even drafted the first drawings for your ship of dreams, you’ve considered how to keep everyone safe and secure, from 1st class to steerage. The people designing the ‘look and feel’ consider how to keep the user interface clear and simple, and the people designing the ‘engine room’ (aka the back-end) think about securing the data in ‘the cloud’ (e.g. using encryption).
4. Full Functionality — Positive-Sum, not Zero-Sum
This principle is about bring ‘balance’ to the process. In other words, privacy by design should be a positive-sum game, where both privacy and functionality are enhanced.
Imagine if your ship could only go fast OR have good fuel efficiency, but not both. Sounds absurd, doesn't it? In the realm of Privacy by Design, you should be able to have your cake and eat it too! You can run a successful business while respecting your customers' privacy. For instance, offering personalised recommendations based on anonymised data ensures both functionality and privacy coexist harmoniously.
5. End-to-End Security — Lifecycle Protection
Security of information should be thoroughly thought through, through the entire lifecycle of your products and services, from collection of date to use, to disposal. This means that personal information should be protected at all stages.
Imagine if you set sail, and had trained people on what to do during the launch, and while at sea, but hadn’t considered the final part of the journey; docking. What happens when you reach port? The likelihood is that there is going to be a whole lot of panic and a possible disaster! That's a bit like having data security measures in place, but only during one or two parts of the process.
Privacy by Design insists on a full life-cycle approach. From the moment you collect data to its eventual deletion. Regularly review and update security protocols to adapt to changing threats, but to put it simply; Think about how data ‘flows’ through your business, and ask yourself “How can we ensure it is safe?”
6. Visibility and Transparency — Keep it Open
You need to be transparent about your privacy practices and give users meaningful control over their personal information. This includes providing clear and concise privacy policies and giving users the ability to access, correct, and delete their personal information if they wish.
If your ship, “Privacy by Design”, set sail and didn’t tell people where they were going, who would be serving them, or what the journey might look like, then your passengers would be quite angry!
Keep your customers in the loop about what you’re doing and how their data is being used. Clearly communicate your privacy policies and practices. When they know you're not hiding anything, they'll trust you more.
7. Respect for User Privacy — Keep it User-Centric
For me, this final principle speaks directly to what GDRP and Data Protection are all about; respect for privacy.
The seventh principle calls for you to respect the privacy of individuals and give them control over their personal information. This means that organizations should remember that they are accountable for the privacy of the data they collect and process.
Privacy by Design means that when you designed the ship you’re on, you did so with the customer (i.e. the User) in mind. You considered how they would board, how they would walk around the deck, and how they would sleep at night. You considered how they would use the space, and what information you would need from them in order for them to have a good experience with you.
Conclusion
So there you have it!
Design your operations with the customer's privacy in mind; Privacy by design, means privacy on purpose! Privacy with intentionality.
By embracing these seven principles of Privacy by Design, you'll be well on your way to sailing the high seas of data protection with confidence. Remember, a well-protected ship is a happy ship, and happy customers are your best crewmates!
Good luck!