The U.S. has never had a national data privacy law. That might be set to change with a new draft bill being debated in both chambers of Congress, with support from leaders in both parties. The American Data Privacy and Protection Act includes requirements that any organization that “collects, processes, or transfers” information that can be linked to a particular individual follow the principles of “privacy by design.” It’s a decades-old idea that the only way to ensure data privacy is to build it into applications in the earliest stages. It’s in Europe’s General Data Protection Regulation as well as Brazil’s national privacy law, among numerous other jurisdictions. But applying that idea to continually evolving technology is likely to require some serious iterating, to use a Silicon Valley term. We asked Ann Cavoukian, who coined the term and came up with seven “foundational principles ” in 1997 when she was Ontario’s information and privacy commissioner, about the history — and the future — of the concept. This interview has been edited for length and clarity. What is privacy by design? Privacy by design is all about baking privacy into the code. It takes the pressure off of individuals — data subjects — from remembering to ask for privacy. What prompted you to create the privacy by design principles? I'm trained in psychology and I wanted to take a psychological approach to it. I wanted to have a proactive model that ideally prevented privacy harms from arising. I wanted to get involved before — not after — the harm happened. So I literally created privacy by design at my kitchen table over three nights and came up with the seven foundational principles and then I took it into the office and I “sold it to them.” The lawyers came along and that's how we developed it. Privacy forms the foundation of our freedom. You have to be free to choose how you want to have your personal information used and to whom you want to have it disclosed. I want this reflected in privacy by design, but also wanted to reflect it's not one interest versus another. It’s not privacy versus security, or privacy versus data utility. I wanted both. I wanted privacy and data utility to go hand in hand. I wanted privacy and data security to go hand in hand. So we did that, and it just took off. What do you think of the privacy by design provisions in the American Data Privacy and Protection Act draft bill? I'm actually quite pleased with this bill because I think it will provide high standards of data security and data minimization. And I think it takes so long in the U.S. to get one of these laws and it's high time; you've gotta move on it now. I think this comes close to doing that — which is saying a lot. It will end the discriminatory use of your personal data. It prohibits the transfer of sensitive data to third parties and without “express affirmative consent.” That's huge. That’s the essence of privacy by design--- that the individual will be the one to consent to the particular uses of their personal data. I thought that was wonderful. I think it's an excellent way to move forward. Nothing is ever perfect, of course, but this has enough in it that I think it will appeal to many groups. How do you see privacy by design evolving in the future, especially with more decentralized systems? It’s all about preserving control for the data subject. If that is reflected in the advances being made, then you are completely consistent with privacy by design. The general principles — they’re general for a very specific reason, because we want to preserve the data subject’s ability to have control. Privacy is all about control — personal control over the use and disclosure of your personal information. If you can capture that through privacy by design — which you can — and then apply it generally in some other development, then you're golden.
| 
