This chapter traces the origins of the Privacy by Design (PbD) concept and leadership by the Office of the Information and Privacy Commissioner (IPC) of Ontario, Canada, from the mid-1990s to the current day (2011), with specific attention to three major themes: The evolution of PbD from its early emphasis on information technologies, which also apply to organizational practices and processes, and to broader information eco-systems and architectures; The evolution of the need to articulate and promote a set of universal principles to help guide the design of privacy, from Fair Information Practices to PbD’s 7 Foundational Principles; An account of the evolving work of the IPC in support of the new or “enhanced” FIPs that were codified in the PbD Foundational Principles. The chapter will outline recognition for PbD received, and the challenges ahead.
TopIntroduction
“Privacy is good for business” has been a longstanding mantra of the Office of the Information and Privacy Commissioner of Ontario, Canada (IPC) that has, within 15 years, become a legal, market and functional requirement, not only for businesses but for ALL organizations ─ public and private sector ─ that handle personal information. The edict is straightforward: build privacy in early and thoroughly into your data management systems, and reap the many rewards that will result from enhanced trust.
In his March 2010 Opinion issued on the eve of a major European undertaking to review and revise European Data Protection Laws, the European Data Protection Supervisor, Peter Hustinx, observed that:
“Trust, or rather its absence, has been identified as a core issue in the emergence and successful deployment of information and communications technologies. If people do not trust ICT, these technologies are likely to fail. … Such trust will only be secured if ICTs are reliable, secure, under individuals’ control and if the protection of their personal data and privacy is guaranteed. To significantly minimise the risks and to secure users’ willingness to rely on ICTs, it is crucial to integrate, at practical level, data protection and privacy from the very inception of new ICTs. This need for a “Privacy by Design” approach should be reflected in the EU data protection legal framework at different levels of laws and policy making” (European Data Protection Supervisor [EDPS], 2010).
His call for a more comprehensive, proactive approach to privacy is being echoed by Data Protection authorities around the world. In October 2010, a landmark resolution was approved by International Privacy and Data Protection Commissioners at their annual conference recognizing Privacy by Design (PbD) as an “essential component of fundamental privacy protection.” The resolution, which was co-sponsored by Canadian Privacy Commissioner Jennifer Stoddart and Commissioners from Berlin, New Zealand, the Czech Republic, and Estonia, also:
- •
Encourages the adoption of the principles of Privacy by Design as part of an organization’s default mode of operation; and
- •
Invites Data Protection and Privacy Commissioners to promote Privacy by Design, foster the incorporation of its Foundational Principles in privacy policy and legislation in their respective jurisdictions, and encourage research into Privacy by Design (International Conference of Privacy and Data Protection Commissioners [ICPDPC], 2010).
Since then, public officials and regulators in the United States and Europe have issued formal proposals and recommendations for Privacy by Design principles to be embedded in reformed oversight and governance regimes for the management of personal information by organizations. More than a concept, Privacy by Design is becoming a legal and regulatory requirement in major jurisdictions around the world.
This paper traces the origins of the Privacy by Design concept from the mid-1990s to the current day (2011), and the leadership of the Office of the Information and Privacy Commissioner of Ontario, with specific attention to three major themes:
- 1.
The evolution of Privacy by Design, from its early emphasis on information technologies, to also apply to organizational practices and processes, and to broader information eco-systems and architectures;
- 2.
The evolution of the need to articulate and promote a set of universal principles to help guide the design of privacy, from Fair Information Practices to the 7 Foundational Principles of PbD.
- 3.
An account of the evolving work of the IPC in support of the new or “enhanced” FIPs introduced by the PbD’s 7 Foundational principles, notably:
- a.
Proactive not Reactive means establishing clear leadership priorities to set and enforce the highest privacy standards, at the beginning of any data usage.
- b.
Privacy Embedded into Design means verifiable commitment to these priorities in all design and operational processes. A systemic program or methodology in place to ensure that privacy commitments are thoroughly integrated into the technology, process or architecture in question.
- c.
Positive-Sum not Zero-Sum means demonstrating practical, measurable and proven results that reflect the positive presence of multiple objectives. All legitimate non-privacy objectives and functionalities should be accommodated (taking an innovative win-win approach).