New innovative technologies that raise privacy issues seem to proliferate on an ever increasing basis. While such developments can bring about certain benefits, all too often new technologies are rolled out with privacy as an afterthought: launch now, deal with privacy concerns as they arise. But the failure to incorporate privacy at the design stages not only offends basic privacy principles; it can be costly.
Consider the launch of Google Buzz this past year. When Google launched Buzz, it effectively turned Google's private e-mail service into a social networking service, raising concern among users that their personal information was being disclosed. Google automatically assigned users a network of "followers" from among people with whom they corresponded most often on Gmail, without adequately informing Gmail users about how this new service would work or providing sufficient information to permit informed consent decisions. In an open letter to Google, a number of data protection authorities around the world expressed concerns about privacy issues related to Google Buzz and that its launch violated the fundamental principle that individuals should be able to control how their personal information is used.
But Google is certainly not alone. Too often, we see new services that fail to take sufficient account of privacy considerations prior to being launched. As our understanding of privacy evolves and new technologies pose novel threats to individual privacy, the debate about how to best protect privacy persists. In Canada, our federal private-sector privacy legislation is grounded in the fair information practices, and by being technology-neutral, has thus far been able to meet the challenges posed by evolving technology and business models. However, more could be done to prevent privacy problems, or to mitigate the effects on privacy protection posed by new technologies, by making the protection of privacy an integral part of the development of new technologies.
Despite the varying approaches to protecting privacy found around the world, one unifying tendency seems to be that the protection of privacy need not be left solely to the regulatory sphere. Instead, it has to start with those entities that use personal information themselves. We need organizations in the public and private sectors to be on board, to think about what they do, how they do it, what they plan to do next and how privacy fits into it all. Our Office, the Office of the Privacy Commissioner of Canada, promotes a more inclusive, systematic and proactive path to privacy. Privacy considerations should be a critical component of the design stage of any new technology or use of technology.
For instance, in our July 2010 submission to the Government of Canada's consultation on a Digital Economy Strategy [PDF], we called for a holistic view that fosters a privacy culture in both business and government, from the design of an initiative through to its implementation. Proactive privacy does more than ensuring the respect of fundamental privacy principles; where the private sector is concerned, it instils customer confidence. Confidence in a key ingredient in ensuring innovation, and businesses are starting to understand that they need to earn their customer's confidence in order to offer new innovative products.
Other data protection authorities in other parts of Canada and the world are calling for "privacy by design" to be required in data protection legislation. The Information and Privacy Commissioner of Ontario, Ann Cavoukian, has been a long-time proponent of the concept of privacy by design. Indeed, at an international meeting of data protection authorities in Jerusalem in October, she put forward a resolution that called on organizations to embed privacy considerations as the default into the design, operation and management of information technologies and systems. The European Commission recently published its plans [PDF] for revising the European Union Data Protection Directive, which, among other objectives, proposes that privacy impact assessments be carried out where appropriate, that privacy enhancing technologies be favoured and that "privacy by design" be an utmost consideration. Privacy needs to be an integral part of business models that rely on technology through a careful analysis of a business' activities.
Privacy impact assessments are a useful tool that private sector organisations should use since such assessments can prevent problems from arising in the first place. In essence, privacy impact assessments help ensure that the protection of privacy is a core consideration when a project is planned and implemented. Integrating such an analysis as part of an organization's risk mitigation strategy helps build a culture of proactive privacy.