The Privacy Engineer's Manifesto. Chapter 2: Basics of Data Privacy and Privacy Engineering
Data privacy, a subset of substantive privacy, individual's right to shape and live life on their terms. Privacy Engineering seeks to bridge the gap b/w policies and their practical implementations.
In today's digital age, the word "privacy" is pervasive, but defining it is no simple task. Its complexity lies in its multifaceted nature, as privacy can manifest in various forms. The primary focus of our exploration is data privacy, known as data protection in Europe, which although prevalent in discussions, is elusive in its consistent global definition.
What Exactly is Data Privacy?
Data privacy is born out of substantive privacy, which stands as an individual's right to shape and live life on their terms. This derivative of substantive privacy emphasizes data about an individual:
Created by the individual.
Formed by others through observation and analysis.
Arising from the use or processing of individual data by external parties.
Privacy comes in various avatars: behavioral, decisional, and physical, each interlinked and sometimes overlapping. However, for clarity, "privacy" here often pertains to "data privacy."
Introducing Privacy Engineering
When developing processes, applications, or systems, the protection of personal data should be inherent. But too often, these protective measures are either overlooked or hastily appended, leading to a subpar user experience, inadequate protection, and user dissatisfaction.
So, what is privacy engineering?
It's an innovative field that employs engineering principles to weave controls and measures into processes, products, and systems, enabling ethical and legitimate personal data processing. This discipline seeks to bridge the gap between privacy policies and their practical implementation, thereby reducing inefficiencies, risks, or both.
Failure to incorporate a privacy engineering approach could lead to various risks. These range from reputational damage and financial loss to criminal repercussions, especially as data systems become intricate and personal data more valuable.
The Vision for the Future
We yearn for a future where privacy engineering becomes so embedded in innovation that it's an instinctive part of any engineering process involving personal information. In such a world, personal data would be revered both as a valuable asset and an entity with intrinsic ethical importance. Every system would be built with this perspective, ensuring its design, implementation, and eventual decommissioning align with these values. However, the realization of this vision demands proactive leadership and collective action.
The Role of Privacy Engineers
Privacy engineers bear the crucial responsibility of:
Crafting processes, products, and systems with embedded privacy features.
Assisting in developing and monitoring privacy policies and guidelines.
Analyzing software and hardware from a privacy and user experience standpoint.
Collaborating with stakeholders to fulfill privacy requirements beyond just the engineering domain.
Ultimately, the adoption of privacy engineering promises a plethora of benefits: robust customer protection, a reliable data platform, and a foundation for top-tier personal information services.
References
[1]: Dennedy, M. F., Fox, J., & Finneran, T. R. (2014). The privacy engineer's manifesto: getting from policy to code to QA to value (p. 400). Springer Nature.