Ear-my-eyes’ is an app that allows users to stream music free. They gather data of users and use those particular data sets to randomly suggest music to users. However, when they were building the app they didn’t consider the privacy implications that could spring from their data processing methodology. After enjoying good reviews from users, their app crashed suddenly and they struggled to get the app back up and running.
In this case, E-M-E app didn’t consider the data protection by design or data privacy by design when building the app. What exactly do privacy professionals mean when they use these terms?
These are rather nuanced terminologies and mean different things technically and functionally. “Data protection by design entails any hardware or software “technical” measures implemented by the business for minimally invasive data processing.”
When organisations use these phrases, “organisational and technical measures”, in their privacy notices they draw water from some of the features in data protection by design. A company that embeds data protection by design would naturally segue into data protection by default (another concept I will expand in another article).
“Meanwhile, privacy by design speaks more to the principles of data minimisation and the overall amount of data collected by a business.” There are many working areas where companies claim to have data privacy by design culture. However, when tested, the technicalities are quite faulty and need further guidance. Ann Cavoukian, a world distinguished privacy expert, highlights seven foundational principles in Data Privacy By Design and they are: (1) Proactive, not reactive; Preventative not Remedial (2) Privacy as a default setting (3) Privacy embedded into design (4) Full functionality (5) End-to-End security – Full lifecycle Protection (6) Visibility and Transparency – Keep it open (7) Respect for user privacy – keep it user centric.
For example, an online retailer sells food items but collects more information than is necessary to process orders. Then that company falls short of data privacy by design. Most companies try to minimise the amount of data they collect but it seems the “gather it all mentality” still holds a strong feature.
In this piece, I attempt to break down the technical differences in these terms and propose a working solution for companies who want to embed a strong data protection by design and data privacy design principles in their overarching data protection framework.
I have presented the meaning of data protection by design and data privacy by design above to sort of ease the reader into the steps that are enumerated below.
The big question then is what should a company pay attention to when building data by protection methodology? We have called it a technical measure. When implementing the technical and organisational measures, companies must consider the following:(1) The state of the art in technology (2)The cost of implementation (3) Nature of processing (4) Scope of processing (5) Context of processing (6) Purpose of processing (7) The varying likelihood and severity of risks in the rights and freedoms of data subjects.
In applying data privacy by design, organisations should pay attention to the following technical options: (1) Decide the Level of Protection Needed (2) Data Mapping (3) Data Minimisation which we touched on above. (4) Deciding the Type of Measure – pseudonymisation, tokenisation, anonymisation, encryption.
These are high level explanations which need further granular elaborations. In the following couple of articles, I will attend to these issues accordingly so that stakeholders in companies can use the methodology in their organisation if they are not doing so already.
