Built-in privacy—no panacea, but a necessary condition for effective privacy protection

Abstract

Built-in privacy has for too long been neglected by regulators. They have concentrated on reacting to violations of rules. Even imposing severe fines will however not address the basic issue that preventative privacy protection is much more meaningful. The paper discusses this in the context of the International Working Group on Data Protection in Telecommunications ("Berlin Group") which has published numerous recommendations on privacy-compliant design of technical innovations. Social network services, road pricing schemes, and the distribution of digital media content have figured prominently in the group's latest working papers. More recently, a judgment of the European Court of Human Rights has thrown light on weaknesses in the protection of patients' data in hospitals that requires urgent action by designers of IT systems. Built-in privacy is no magic button, no panacea, but it has turned out to be a necessary condition for meaningful privacy protection. Keywords Social networks. Road pricing. Locational privacy. Distribution of digital media content. Hospital IT systems. Web-based telemedicine. Electronic health records. International Working Group on Data Protection in Telecommunications. "Berlin Group" "Locking the stable door after the horse has bolted"-this has been for too long a rather accurate description of what Privacy and Data Protection Commissioners and other regulators have been doing. They have tried to enforce rules and laws and to assist/support data subjects after their rights had been violated. Many regulators are lawyers, and this is what lawyers are trained to do and consequently used to doing, but it has turned out to be insufficient to protect privacy by relying solely on reactions and sanctions for not abiding by the rules of data/privacy protection. Very often data controllers claim to be unable to comply with the rules because there is no

Big Data in the workplace: Privacy Due Diligence as a human rights-based approach to employee privacy protection

“…A broader privacy approach is necessary. We have shown that PbD with its tech-based solutions is no panacea because there is no simple fix for complex privacy challenges (Dix, 2010;Hartzog, 2018). Whilst companies have an interest in ensuring the employee productivity and preventing misconduct in the workplace, the measures to uphold that interest do not justify extensively invasive practices for quantifying the social modes of interaction and connected performance goals (Ajunwa et al, 2017).…”

“…The expectations for PbD from scholars from different continents and disciplines are high: PbD is described as a pragmatic compliance enabler to guarantee important elements of procedural regularity (Kroll et al., 2017; McQuay and Cavoukian, 2010). Some scholars claim that it will be difficult if not impossible to achieve meaningful privacy protection in the 21st century without PbD (Dix, 2010). Indeed, design-based approaches are popular even beyond the tech industry and have increasingly found their way into legal frameworks.…”