Privacy by Design
Last month I finally bought a new smart phone. Now I am not here going to talk about the great features. There are enough blogs out there explaining you the difference between Iphones and Androids. What I wanted to talk about is the installation of all the apps. And specifically that screen you see during the installation with all the stuff you are about the share. Or maybe known to others as the screen with a lot of information you where you click ‘Accept’ without reading.
That screen made me wonder to what extent it is necessary that I share that much information to make an application to work. How much privacy am I actually willing to give up to play a small game or to be able spice up my pictures with a nice seventies look?
For me – as an individual – the most important is that I am willing to give up some personal information, as long as I get the feeling the company who is asking the information will handle my private information with care. But the small screen I mentioned early does not really make this clear to me. It only tells me what I have to ‘give up’.
Thanks to my friend Martin van Rijn I found out about an interesting concept which deals with my issue, namely ‘Privacy by design’. Now being from an IT service management/ITIL background I am fully aware we have something called Information Security Management or ISO27000.
But as I stated earlier in one of my posts we tend to put the infrastructure in the centre spot when practicing ITIL. (Sorry, the post is only available in Dutch). And in my opinion (and of a lot of other people) we should put the human being in the centre.
Processes and standards like ISO 27000 do help in security, but do not handle privacy. As the Oxford Dictionary states : “privacy ~a state in which one is not observed or disturbed by other people”. Which means privacy should be seen from a human and individual perspective.
The “Privacy by Design” concept is based on 7 principles, namely:
1. Proactive – prevent privacy-invasive events before they happen.
2. By default – personal data are automatically protected in any given IT system or business practice.
3. Embedded – not an add-on, but integrated into the design and architecture of IT systems.
4. Positive-sum – a “win-win” scenario is achieved rather than having a trade off of security over privacy.
5. Lifecycle protection – at the end of the process, all the data are securely destroyed in a timely fashion.
6. Visibility / Transparency – a technology or business practices is operating according to stated promises and objectives, subject to independent verification.
7. Respect for users – interests of the individual are uppermost.
For me the most important principles are 2 and 7. In my opinion these ask for a culture changes in a lot of companies. Just like with any other subject it starts with building awareness within the organisation.
Furthermore I would like to point out one of the 10 rules for good design by Dieter Rams. One his rules state ‘Good Design Is as Little Design as Possible’. Less, but better – because it concentrates on the essential aspects, and the products are not burdened with non-essentials. Back to purity, back to simplicity.
And if I would apply this rule to Privacy by Design from my perspective it would mean that I would only have to share private information when it is used for the function of the service or product. Keep it simple for me, which also means, that I can revoke any given rights easily.
The “Privacy by Design” is still developing, and there are not a lot of tools in place. One very concrete one is the Privacy Impact Analysis. It consists of key questions which need to be answered when starting a new project.
Next to that I was very excited about the website http://privacypatterns.org/patterns/