Privacy By Design

Privacy By Design is a key concept in the study of modern data privacy.

It’s incorporated into the text of the GDPR as a core principle, and its influence is considerable across a number of data privacy laws worldwide. The key figure in Privacy By Design’s development was Dr. Ann Cavoukian, Information and Privacy Commissioner for Ontario from 1997-2014.

In the foreword of Cavoukian’s groundbreaking work, former FTC Commissioner Pamela Jones Harbour stated:

“There must be some balance between regulation and innovation. One way to achieve that harmony is to embed privacy features from the beginning, starting with the design specifications of new technologies, i.e., Privacy by Design.”

If you’re interested, you can read Cavoukian’s full Privacy By Design White Paper here. The concept is based on seven “foundational principles.” Any organization must carefully consider each one in order to fully incorporate Privacy By Design.

1. Proactive not reactive
2. Privacy as the default setting
3. Privacy embedded into design
4. Full functionality – positive-sum, not zero-sum
5. End-to-end security – full life-cycle protection
6. Visibility and transparency – keep it open
7. Respect for user privacy – keep it user-centric

There’s a great Medium explainer on what each of these terms means here.

Some GDPR commentators have expressed a wish that Privacy By Design contained more actionable specifics and less vague principles. They might have an argument, but it remains a key concept for data privacy regulators all over the world.