What is Privacy by Design and Privacy by Default?
Privacy by Design and Privacy by Default are foundational principles that aim to embed data protection throughout the data processing lifecycle.
Privacy by Design focusses on integrating data protection into the design and development of data processing activities, proactively anticipating and mitigating privacy risks instead of addressing them as an afterthought or add-on compliance measure.
Privacy by Default ensures that data processing activities are set to the most privacy-friendly settings by default, collecting the bare minimum amount of personal data necessary for the specific purpose.
Key principles of Privacy by Design and by Default
- Proactive and Preventative: Anticipate and avoid privacy risks before they occur.
- Embedded into Design: Integrate privacy into the core functionality and architecture of products and services.
- Default Privacy Settings: Ensure the highest level of privacy protection by default.
- Positive-Sum Outcomes: Achieve multiple objectives (e.g., security, usability) without compromising privacy.
- End-to-End Security: Protect personal data throughout its lifecycle using measures like encryption and anonymisation.
- Transparency and Accountability: Provide clear information about data processing activities and subject them to independent verification.
- User Empowerment: Respect and prioritize user privacy rights, giving them control over their personal data.
Why are Privacy by Design and by Default important?
Data privacy by design and by default are important for several reasons.
First, they help to comply with the legal obligations and ethical principles of data protection, such as the General Data Protection Regulation (GDPR) in the European Union. This requires data controllers and processors to implement data protection by design and by default as part of their accountability and risk management. Failure to do so can result in substantial fines and penalties, not to mention reputational damage.
Second, they help to enhance the trust and confidence of data subjects, customers, and stakeholders, who rely on the fact that their personal data is treated with appropriate care, and that their privacy rights and preferences are respected. (This can be used as an important competitive advantage in certain industries.)
Third, privacy by design and by default help organisations prevent or mitigate the potential risks and harms of data breaches, and data misuse or abuse, which can result in financial, reputational, or legal damages, as well as psychological or physical harm to the data subjects.
But that’s not all. Data privacy by design and by default also:
- Enhance security through end-to-end protection and proactive preventative strategies.
- Improve operational efficiency by streamlining processes and unlocking cost savings.
- Empower users to make informed decisions about their privacy with the confidence that their rights are being respected.
- Help maintain a balance of interests with other objectives like usability and innovation.
How do Privacy by Design and by Default differ?
While their intentions are similar, privacy by design and privacy by default are not identical in application. Key differences include:
- Scope: Data privacy by design applies to the entire data processing lifecycle, from the initial design stage to the final disposal. Data privacy by default applies to the initial settings and options of any data processing activity.
- Flexibility: Data privacy by design involves embedding and integrating privacy into the core functionality and architecture of any product, service, or system. Data privacy by default involves providing the highest level of privacy protection as a standard feature that can be changed or disabled by the user.
- Limitations: Data privacy by design enables the achievement of multiple objectives and interests, such as security, usability, or innovation, without compromising or sacrificing privacy. Data privacy by default may limit some of the functionality or benefits of data processing for the sake of privacy.
- Transparency: Data privacy by design enhances the transparency and accountability of data processing activities, by providing clear and accurate information and by subjecting them to independent verification and audit. Data subject empowerment: Data privacy by design respects and empowers the data subjects, by giving them control and choice over their personal data, and by honouring their rights and preferences. Data privacy by default may not adequately reflect the needs and expectations of the data subjects.
How does Microsoft support Privacy by Design and by Default?
Microsoft takes a comprehensive and proactive stance on privacy, both in terms of meeting their own privacy obligations, and enabling their users to do the same.
Privacy by design and by default are incorporated into all Microsoft products and services, with the following capabilities particularly useful for Microsoft users looking to fulfil their own privacy obligations.
- Data Discovery and Classification: Identifying and labelling personal and sensitive data according to predefined policies.
- Data Lineage and Mapping: Tracking and visualising data flow and transformation, ensuring transparency and accountability.
- Data Compliance and Reporting: Monitoring compliance with regulations like GDPR and providing performance metrics.
- Data Collaboration and Access Control: Facilitating secure data sharing and access while respecting privacy rights.
Adaptive Protection for Privacy by Design and by Default
Adaptive Protection in Microsoft Purview’s Insider Risk Management promises to be particularly valuable in the quest for data privacy by design and by default.
It uses machine learning and AI to continuously assess data processing activities, dynamically applying and adjusting appropriate Data Loss Prevention (DLP) and Information Protection controls based on user behaviour and risk levels.
This ties very neatly into privacy by design and default principles, ensuring proactive – but proportional – protection is always in place without the need for overly restrictive baseline settings that limit collaboration and sharing.
Adaptive Protection is currently available with an E5 licence. Get in touch to learn more about deploying it within in your environment.
