Privacy Principles by Design

"Privacy by design" is a concept that has been tossed around a lot lately, and it’s one that's becoming increasingly important in our data-driven world. It essentially means that when you're creating a new product, service, or system, you should consider and integrate privacy protections from the very beginning, rather than treating it as an afterthought, so really, it’s more like “privacy integrated into the design.”

Think of it like this: instead of building a house and then trying to add a security system later, you're incorporating things like strong locks, alarm systems, and maybe even a moat with sharks (okay, maybe not sharks) into the initial blueprints.

In the context of data privacy, this could mean things like:

• Minimizing data collection: Only collect the data you absolutely need.

• Giving users control: Allow users to access, correct, or delete their data.

• Building in security: Use encryption and other security measures to protect data.

• Being transparent: Be open about how you collect, use, and share data.

By incorporating privacy from the get-go, you can build trust with your users and avoid potential privacy issues down the road.

Now, let’s go even deeper into the concept of Privacy by Design, with a particular focus on a practical, risk-based approach that I created and refer to as “Privacy Principles by Design.” This approach is particularly well-suited for startups, SMBs, and entrepreneurs who are navigating the complexities of data privacy regulations, such as the General Data Protection Regulation (known more commonly as GDPR).

Understanding the GDPR Challenge

The GDPR, as you may know, is a substantial piece of legislation. It's 261 pages long with 99 articles. That's a lot to digest! Traditionally, privacy by design meant building your entire data processing system with every single one of those GDPR requirements in mind. That's a daunting task for any organization, let alone a smaller, growing business. The sheer volume and complexity of the requirements can be overwhelming, leading to potential delays, increased costs, and the risk of non-compliance.

Introducing “Privacy Principles by Design”

This is where the “privacy principles by design” approach comes in. Instead of getting bogged down in the minutiae of specific requirements, we focus on the core principles of the GDPR. These principles, which are at the heart of the regulation, include:

• Lawfulness, fairness, and transparency: Processing personal data in a lawful, fair, and transparent manner.

• Purpose limitation: Collecting personal data only for specified, explicit, and legitimate purposes.

• Data minimization: Collecting only the minimum amount of personal data necessary for the intended purpose.

• Accuracy: Keeping personal data accurate and up-to-date.

• Storage limitation: Limiting the storage of personal data to the necessary period.

• Integrity and confidentiality (or security): Ensuring the security of personal data through appropriate technical and organizational measures.

• Accountability: Demonstrating compliance with the GDPR principles.

By aligning your data processing activities with these principles, you're essentially building a strong foundation of compliance. It's a more achievable goal, especially for businesses with limited resources. And the risk-based approach that we apply in our strategic consulting process allows you to demonstrate a reasonable level of compliance early on, which is crucial for attracting investors, getting business from customers (especially enterprise customers), satisfying regulators, and avoiding the "technical debt" of non-compliance down the line.

Building a Strong Foundation

Going back to that house analogy, the GDPR requirements are like the detailed blueprints with all the tiniest details annotated, but without a key to interpreting all those symbols you’re looking at, while the principles of GDPR are the fundamental building codes - the rules that you follow in construction to make sure your final product is fundamentally safe. Focusing on the principles ensures that your foundation is strong, even if you haven't added all the finishing touches yet.

Advantages of the Privacy Principles by Design Approach

• Sustainable Competitive Advantage: By proactively addressing privacy concerns and demonstrating compliance, we can help you differentiate yourself from competitors and build trust with customers.

• Mitigation of Regulatory Risk: While startups and smaller businesses may not face the same level of scrutiny as large corporations, compliance is still essential. A principles-based approach helps reduce the risk of penalties.

• Avoid a Regressive Tax.  Unfortunately, GDPR applies to all businesses equally, with no allowance for differences in size or revenue. The financial cost of compliance for startups and SMBs can represent a much larger investment relative to their overall operating budget compared to large corporations. A principles-based approach enables you to maximize the “I” in your compliance R.O.I. and avoid paying for compliance with a lower “R.”  In our house-building analogy, it’s like if your town had one electrician who charged a flat rate no matter how big the building is or how long the work would take - you’re building a bungalow, but you’re paying the same amount as the giant construction conglomerate downtown that’s building a skyscraper.

• Positive Impression for Investors and Customers: Demonstrating a commitment to privacy principles can attract investors and reassure customers, especially enterprise customers, that their data is being handled responsibly. Companies who demonstrate privacy compliance see significant increases to their valuations, especially where that compliance is related to their core business activities.

• Solid Foundation for Future Growth: As your business grows and evolves, we can build upon this foundation and develop a more comprehensive privacy program that adapts to changing regulatory requirements - especially as you expand and are subject to new regulations - and business needs.  While GDPR applies to all businesses equally, the bigger your business gets, the more scrutiny you’ll attract from regulators, and those regulators often hold larger businesses to a higher standard and expect greater sophistication in their privacy compliance.

GDPR's Global Impact

Remember, GDPR is not just European regulation. It has global implications.  First, due to what’s known as “extraterritorial application,” even if you’re not located in the EU or UK, GDPR’s rules still apply to your business as soon as you process the personal data of any EU or UK citizen. Also, by adopting our Privacy Principles by Design approach, you're not just complying with GDPR, you're preparing your business for a global landscape of data privacy laws. Many other countries and regions have implemented or are implementing or considering similar regulations based largely on GDPR. The principles enshrined in the GDPR already are, or are likely to be, reflected in these laws.

Strategic and Proactive Approach

In essence, Privacy Principles by Design is about being smart and strategic. It's about understanding the spirit of the law, not just the letter of the law. It's about building a culture of privacy within your organization. And it's about positioning your business for success in a world where data privacy is increasingly important.

We can work with your business to embrace the principles of privacy by design.  Returning to our house analogy, even if you are a general contractor yourself, you can’t just decide to break ground on a new building one day - you need experts like engineers, architects, people to check that everything is up to code so you have a solid plan and path forward to make sure what you’re building will stand the test (or tests) of time.

By working with Aetos to create this strategic blueprint for your company, you're taking a proactive step towards protecting your business, your customers, and your future by building a foundation for sustainable growth in a privacy-conscious world. Remember, privacy is not just a compliance issue; it's a business opportunity.

By prioritizing privacy, you can:

• Enhance Customer Trust: Demonstrating a commitment to protecting customer data fosters trust and loyalty. In an era where data breaches and privacy concerns are prevalent, prioritizing privacy can be a key differentiator for your business.  Enterprise customers, in particular, are sensitive to introducing risks from vendors or other businesses into their own privacy and security ecosystem, and your business’s ability to demonstrate a savvy level of compliance can provide you with a significant advantage in winning those deals.

• Mitigate Legal and Financial Risks:  Proactive privacy measures help you navigate the complex and rapidly evolving regulatory landscape, reducing the risk of legal disputes, fines, and reputational damage.

• Gain a Competitive Advantage:  Businesses that prioritize privacy position themselves as leaders in their industry, attracting customers and investors who value their data security and privacy. This is especially true for your core business activities. Regulators have turned to a new deterrent for businesses that are built on data that was processed in non-compliant ways - they’re calling it “algorithmic disgorgement,” which is a scary not-safe-for-work-sounding way to say that they have required businesses who have built their products, code, AI systems, algorithms, etc. by processing data (even a little bit) in violation of privacy laws to delete not only that data, but also the resulting products, code, AI systems, algorithms, etc. that they created using that data. This type of penalty could quickly bring about the collapse of a business or scare away potential investors who don’t want to inherit that risk.

• Foster Innovation: A privacy-centric approach encourages innovation by promoting the development of new technologies and business models that respect and protect user privacy.

If you embrace privacy as a core business value and integrate it into your strategic planning, you can build a resilient and successful organization that is well-prepared for the future. Remember, privacy is not just a checkbox to tick; it's a fundamental aspect of building a sustainable and trustworthy business in the digital age.

What is personal data? And what is Personally Identifiable Information?

Demystifying "Personal Data" under the GDPR

The General Data Protection Regulation (GDPR) is all about protecting personal data, but what exactly falls under that umbrella? Let's break it down in a way that's easy to understand.

Personal data, in the eyes of the GDPR, includes any information that can be used to identify a living individual. This can be done:

• Directly: The information itself clearly identifies the person (e.g., their name, ID number).

• Indirectly: Combining the information with other data points reveals the person's identity (e.g., their location data combined with their job title).

Here are a few important points to keep in mind:

• Pseudonymized data is still personal data. Even if you replace identifying information with pseudonyms, it can still be considered personal data if it can be linked back to an individual.

• Truly anonymized data is NOT personal data. Anonymization means the data is irreversibly de-identified, making it impossible to re-identify any individual. This is a high bar to clear!

• Information about a deceased person is not personal data. The GDPR focuses on protecting the data of living individuals.

• Information about companies or public authorities is not personal data. However, information about individuals within those entities (like sole traders or employees) can be personal data if it relates to them as individuals.

Identifiers and the Context Conundrum

An identifier is anything that helps distinguish one individual from another. While a name might seem like an obvious identifier, whether it actually identifies someone depends on the context.

For example, the name "John Smith" alone might not be enough to identify a specific person. But if you combine it with other information, like their address or date of birth, it becomes much easier to pinpoint who they are.

The GDPR provides a list of potential identifiers, including:

• Name

• Identification number

• Location data

• Online identifiers (like IP addresses and cookie identifiers)

But remember, context is key! Even seemingly innocuous information can become an identifier when combined with other data points.

Personally Identifiable Information vs. Personal Data: What's the Difference?

In the world of data privacy, you'll often encounter the terms "Personally Identifiable Information" (or PII) and "Personal Data." While they might seem interchangeable, there are key distinctions, especially when considering different legal frameworks and geographical contexts. Let's break down the nuances:

PII

• Origin: Primarily used in the United States.

• Definition: Information that can uniquely identify an individual or be linked to a specific person.

• Scope: Generally focuses on specific types of data that directly identify someone.

• Examples: Name, Social Security Number, passport number, email address.

• Emphasis: On data used for direct identification.

Personal Data

• Origin: Commonly used in the European Union and other countries, particularly in privacy laws like the GDPR (General Data Protection Regulation).

• Definition: Any information relating to an identified or identifiable natural person (referred to as a "data subject").

• Scope: Broader than PII, encompassing data that might not directly identify a person but can do so when combined with other information.

• Examples: Name, IP address, cookie identifiers, location data, and even pseudonymized data if it can be re-linked to an individual.

• Emphasis: On how data relates to individuals, even if identification requires additional steps or combining data points.

Key Differences at a Glance

Our handy table to compare PII and personal data.

Why It Matters

Understanding the difference between PII and Personal Data is crucial for businesses operating in different regions or handling data from diverse sources. The GDPR's broader definition of Personal Data means that companies must be more vigilant in protecting a wider range of information.

In summary, Personal Data is a more comprehensive term under the GDPR, while PII focuses on specific identifiable details, often in the US context.

Is it Personal Data? Unpacking Identifiability Under the GDPR

So, the GDPR is built on the concept of personal data. But what exactly is personal data? It's not always as straightforward as you might think. Let's break down the key elements of identifiability under the GDPR:

Direct Identifiability

Can you identify an individual directly from the information you have? If you can distinguish an individual from others solely by looking at the information you're processing, that individual is considered identified or identifiable.

It's important to remember that direct identifiability goes beyond just knowing someone's name. A combination of other identifiers, such as location data, online identifiers, or physical characteristics, may be enough to pinpoint an individual. If this is the case, the information may constitute personal data under the GDPR.

Indirect Identifiability

Even if you can't identify an individual directly from the information you hold, it might still be considered personal data if it can indirectly identify them. This means that by combining the information you have with other readily available information, an individual could be identified.

Consider these factors when assessing indirect identifiability:

• The information you already hold: Could it be combined with other data you possess to identify an individual?

• External information sources: Could someone use publicly available information or data from other sources to identify an individual based on the information you hold?

• Technological advancements: Could new technologies or data analysis techniques make it easier to identify individuals in the future?

While the GDPR considers the possibility of someone reconstructing data to identify an individual, a slight hypothetical possibility isn't always enough. You need to assess the likelihood of identification based on the means reasonably likely to be used by a determined individual.

The "Relates To" Requirement

For information to be considered personal data, it must also "relate to" the identifiable individual. This means the information must concern the individual in some way, not just identify them.

To determine if data "relates to" an individual, consider:

• Content: Is the data directly about the individual or their activities?

• Purpose: Why are you processing the data?

• Effects: What are the results or effects of processing the data on the individual?

Data can reference an identifiable individual without being personal data if it doesn't relate to them. For example, a dataset listing company names might include the name of a person who owns a business, but if the data is used for market analysis and not in a way that concerns the individual, it might not be considered their personal data.

When in Doubt, Proceed with Caution

In cases where it's difficult to determine if data is personal data, it's best to err on the side of caution. Treat the information with care, ensure you have a lawful basis for processing it, and implement appropriate security measures for its storage and disposal.

Remember, even inaccurate information can be personal data if it relates to an identifiable individual.

When Does Data Become Personal?

The GDPR has a broad definition of "personal data," encompassing any information relating to an identified or identifiable natural person. But what happens when the same data is processed by different organizations for different purposes? Can data be considered non-personal in one context and personal in another?

The answer is yes. The GDPR recognizes that data's relationship to an individual can change depending on the controller and their purpose for processing it.

For example, anonymized data that doesn't identify individuals for one controller might become personal data in the hands of another controller who has access to additional information that allows for identification.

Therefore, it's crucial to carefully consider the purpose for which data is being used to determine whether it falls under the GDPR's definition of personal data. A thorough analysis is essential to ensure compliance and avoid inadvertently processing personal data without a lawful basis.

Sensitive Personal Data Under the GDPR: Extra Protection for Sensitive Information

The GDPR provides heightened protection for "sensitive personal data," which includes categories of information that could be particularly harmful or discriminatory if misused. These categories are:

• Racial or ethnic origin

• Political opinions

• Religious or philosophical beliefs

• Trade union membership

• Genetic data

• Biometric data (for identification purposes)  

• Health data  

• Data concerning sex life or sexual orientation

Due to the sensitive nature of this data, the GDPR imposes stricter rules and requirements around its processing. This includes obtaining explicit consent from individuals, implementing appropriate safeguards, and conducting data protection impact assessments (DPIAs) in certain cases.

"Personal Information" Under the CCPA

A Broad Definition

Similarly, and yet a world apart, the California Consumer Privacy Act (CCPA) also has a broad definition of "personal information." It includes any information that identifies, relates to, or could reasonably be linked to a California resident or their household, directly or indirectly. This encompasses a wide range of data, including:

• Identifiers: Name, email address, IP address, online identifiers

• Commercial Information: Purchase history, browsing history

• Geolocation Data: Precise location data

• Professional or Employment-Related Information: Employment history, education information

• Profiles: Profiles created about consumers by businesses, including pseudonymous profiles

• Sensitive Personal Information: A subset of personal information with heightened protection (see below)

"Sensitive Personal Information" Under the CCPA: A Closer Look

The CCPA defines "sensitive personal information" as a specific category of personal information that requires even greater protection. California residents have the right to limit the use and disclosure of their sensitive personal information to only certain permitted purposes. This category includes:

• Government identifiers: Social Security number, driver's license, state identification card, passport number

• Financial account information: Account login, debit or credit card numbers, security codes, passwords

• Precise geolocation: A consumer's precise location

• Contents of mail, email, and text messages: Unless the business is the intended recipient

• Genetic data

• Biometric information: Processed for identification purposes

• Health, sex life, or sexual orientation information

• Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership

By understanding the nuances of "personal information" and "sensitive personal information" under both the GDPR and the CCPA, businesses can ensure they are handling consumer data responsibly and complying with these important privacy laws.

---

Understanding the nuances between "personal information" and "sensitive personal information" under both the GDPR and the CCPA is crucial for businesses operating in today's data-driven world. By recognizing the distinct definitions and requirements of these privacy laws, organizations can ensure they are handling consumer data responsibly and ethically.

While the concepts of PII and personal data may seem complex, remember that the core principle is the same: protecting individuals' privacy. By prioritizing data protection and implementing robust compliance measures, businesses can foster trust with their customers, enhance their brand reputation, and contribute to a more responsible and ethical digital ecosystem.

If navigating these complexities feels overwhelming, Aetos Data Consulting is here to help. We offer expert guidance and tailored solutions to ensure your business complies with global data privacy regulations and handles personal data with the utmost care and respect. Contact us today to learn more about how we can support your journey towards data privacy compliance.