IEEE Consumer Electronics Magazine - March/April 2020 - 79

sectors of the economy, have one thing in common: they have chosen to put privacy at the center of their product and service developments,
and have found that it gave them a competitive
edge. Learning from these businesses about the
keys to their successful PbD implementation can
help organizations across industries understand
how PbD can enhance their corporate interests,
while offering the strongest privacy and data
protection to achieve multiple goals. It is a clear
win/win!
PbD has been widely acclaimed for its benefits
to both businesses and consumers; it offers a road
map to build much-needed privacy protections
into new applications, tools, and services, so that
developers may begin their design process by
thinking about privacy. As seen too frequently in
the media, recent news stories show us the frequency and dire consequences of those who overlook the importance of privacy, as incidents of
data breaches and data mishandling continue to
rise. PbD offers a way for businesses to avoid these
problems by not simply thinking about privacy as
an add-on after new products and services have
already been designed, developed, or launched,
but rather to lead with, and factor privacy into, the
process of creating new offerings.
Moreover, PbD is becoming the norm for
international privacy compliance. Europe's General Data Protection Regulation (GDPR) incorporates "data protection by design" and "data
protection by default" (the second Foundational
Principle of PbD), into its requirements for
organizations under Article 25. These GDPR legal
requirements build on the Foundational Principles of PbD. The European Data Protection Commissioner defines PbD as: "The broad concept of
technological measures for ensuring privacy as
it has developed in an international debate over
the last few decades," while the term "data protection by design" refers to the focused requirements in Article 25, which represent a direct
proactive implementation and application of the
more visionary and ethical dimensions of PbD.
As media attention continues to focus on incidents of privacy misdeeds, the interest and use of
PbD are further expanding. Soon, a new International Standards Organization standard for PbD
(currently before the ISO project committee ISO/
PC 317, and distinct from ISO/IEC 27701, which

March/April 2020

includes PbD within broader privacy and security
requirements) will become a best practice for businesses around the world interested in building privacy protections directly into their products and
services. Likewise, business models building
around PbD with consulting firms are becoming
affiliated with research centers and certification
groups in order to enhance the knowledge of PbD
within organizations. However, a hurdle for some
organizations to fully implement PbD into business
practices remains the challenge of building, what
is at times characterized as a complex set of principles into a practical set of business standards
applicable to day-to-day business functions. And
yet the foundational principles of PbD were
intended to be proscriptive, pointing the way forward to being applied to a particular company's
operations.
Many businesses have taken up the cause of
implementation, and have witnessed the tremendous success that PbD can bring to a business.
Businesses that have embraced the possibility of
PbD for their new initiatives make it clear that simple steps go a long way to making PbD a game
changer for businesses that can greatly enhance
the customer trust with organizations. One early
adopter of PbD in Canada was TELUS Communications, Inc. TELUS successfully embraced PbD principles, not simply in their corporate policies,
but by customizing the seven PbD principles
into practical business guidance, which is then
reinforced through training and project-specific
implementation and partnerships.
As referenced above, PbD thinking is powered by its seven Foundational Principles:
1) proactive not reactive, which focuses on
prevention;
2) privacy as the default setting;
3) privacy embedded into design;
4) full functionality (not zero-sum!);
5) end-to-end security;
6) visibility and transparency; and
7) respect for user privacy.
From these essential principles, large consulting houses such as Deloitte and KPMG have developed criteria and controls that add the functional
considerations for the implementation of these
principles into successful business practices.

79
IEEE Consumer Electronics Magazine - March/April 2020

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - March/April 2020
