Privacy by Design  

Recent developments in the Privacy by Design approach to identifying, classifying, and applying the right protection mechanisms on sensitive data consist of two parts. One is privacy-preserving technology, primarily concentrating on people and processes to protect the customer from regulators, fines, and sanctions by identifying the sensitive data, classifying them according to their criticality, and making them available whenever it is needed. On the other hand, privacy-enhancing technology helps the organization protect the data to enable them in analyzing the data inside or outside of the organization for data trends, competitive advantages, streamlining the process of data minimization, facilitating legacy application retirement, and minimizing or nullifying the data exposures and breaches.  

Privacy-Preserving Technology  

At a high level, we can see that every organization’s objective is to comply with business and country-wide privacy regulations to keep their brand and business reputation. When we look at the GDPR compliance requirements articles 5, 6, 7, 9, 13, 14, 17, 20, 25, 30, and 36, they provide a clear mandate for the privacy requirements on how the data is collected from various sources, processed, and stored within and outside of the organization, shared with the right teams to monetize the data, and transferred to other EU region and with user consent based on the needs. On the other hand, US CCPA compliance mandates similar kinds of requirements for consumer data privacy in their regulation articles 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.121, 1798.130.  

The below figure details the Privacy Preserving Technologies used for privacy enablement. 

When it comes to business regulations, mandates like PCI DSS, Article 7 Restrict Access to System Components and Cardholder Data by Business Need to Know function to ensure that in financial institutions, unauthorized users must not have access to critical data and there must be a process in place for authorized users to have those data. Likewise, HIPAA Part 164 and its subsections require similar kind of privacy requirements on how users and data are collected, processed, and shared with user consent.  

So, it becomes evident that privacy is becoming the primary objective for organizations and regulatory bodies.  

Privacy-Enhancing Technology  

When we look at the Privacy-Enhancing Technology which is the second part of Privacy by Design again the GDPR Articles 5, 25, 28, 30, 32, 33, 34, & 45 mandate the protection of personal and sensitive data using cryptographic techniques while collecting, storing, processing, and sharing data with the controllers, processors, and within EU governing bodies. Likewise, CCPA regulations 1798.140 and 1798.150 provide guidelines to organizations on what types of data are considered sensitive and personal data and how they can be safeguarded from data breaches.  

The below figure details the Privacy-Enhancing Technologies used for data protection.  

On the other hand, PCI-DSS requirements 2, 4, 3, 5, and 6 provide detailed guidelines for how the sensitive data need to be protected and requirements 7,8,9, and 10 provide detailed guidelines for how the sensitive data to be accessed securely and monitored in payment card industry. HIPAA Part 164.304, 164.310, and 164.312 provide details about how the guidelines of the standards protect electronic health records.  

Privacy First or Protection First? 

Similarly, most of the country-wide regulations and business security regulatory requirements provide guidelines for data privacy and protection guidelines. From the implementation side, privacy requirements can be done at any stage of the application development cycle, even when the application is live already. However, the protection strategies are a bit complex and difficult as it needs to be planned from the design stage itself. If the protection is done after the application is developed, it puts constraints on the applications to share the protected data for various monetization requirements including analytics. It requires a lot of computation to decrypt the data, encrypt the data with a different key to share with the analytics team, and decrypt them to validate the analytical outputs. Privacy by design approach weaves both Privacy-Preserving and Privacy-Enhancing Technologies together while architecting the applications.  

To guard against fines, and reputation loss due to non-compliance to privacy most businesses are preferring to implement the privacy first strategy, as, it is their Objective to guard against those losses first. And adapting protection as subjective wherever required depending on the requirement and data type, by, applying appropriate protection mechanisms like encryption, masking, and tokenization.  

Privacy by Design Approach 

Standards & regulation organizations Like NIST, ISO, non-profit organizations like ENISA, and regulatory bodies like GDPR provide some guidelines in Privacy by Design approach for product, solutions, and application development. Most of the recommendations are around data about how it can be protected using technology and what is the process to be defined around data for its access, authorization to modify, and how it can be processed.  

ENISA summarizes the privacy by design in the below figure. 

The purpose of the Privacy by Design approach is to help organizations in defining the process to discover and understand the information in their applications and databases, classify them for privacy, use that information to assess and visualize risk, and make decisions around that data to minimize the risk. Once the risk profile is drawn, then plan to ensure that it is preserved and securely shared across the organization. This will enable organizations to understand their information are needed to be managed short, medium, or long term and be able to defensively delete that information, manage its lifecycle over time and expedite the audit response for legal audits and investigations. 

What are the data to be protected and when they must be protected will be derived from the discovery and classification process. The protection mechanisms allow organizations to find ways in which they can leverage that data so that they can achieve greater standards in terms of innovation and competitive advantage to monetize that information. This can be achieved by transforming data using encryption, tokenization, masking, and hash functions. If the privacy-protected data can be shared with analysts without decrypting the data when they are protected using format-preserved encryption, secure stateless tokenization, and format preserved hashing, reduces the data monetization and analysis cycle significantly.  

Data is growing day by day and recently organizations are looking at ways to optimize and monetize the data than worry about their growth. When they optimize and monetize the data, growth, and cost optimization of data are taken care of by themselves.  

Most of all data optimization paves a way for green initiatives of the organization as explained in this blog - Improving Sustainability with the Privacy by Design Approach.