Privacy by design

Protecting personal information can't be an afterthought. Steve Cassidy explores how to put data privacy first

- Steve Cassidy

Privacy by design – sounds like a lot of expensive re-engineering?

In the context of legacy systems and processes it probably would be very costly to implement. “PbD”, as it’s familiarly known, isn’t a feature you can quickly tack on to an existing system. As the name implies, it’s a principle that’s baked in, not even at the point of development but at the whiteboard phase, before anyone has written a line of code. Originally developed by Dr Ann Cavoukian back in 1995, it’s become a global gold standard for systems design.

So it’s not something we can meaningfully act on right now?

If you’re not currently architecting new systems then you’re not going to be in a position to implement true, bottom-up PbD. However, you can build its principles into almost any project, of any scale – the main one being that personal data should be private by default, and only made accessible to people and processes with the express, informed consent of the person it refers to. It’s also good practice to collect only a minimum of data that’s necessary for a specific business purpose, and to delete it once that purpose has been served.

Is it worth the effort to change the way we handle data?