19 - Blending the Practices of Privacy and Information Security to Navigate Contemporary Data Protection Challenges

Summary

INTRODUCTION

The relationship between European privacy regulators and predominantly American technology businesses can seem increasingly fraught A string of adverse (and sometimes counter intuitive) privacy findings against digital businesses – including the ‘Right to be Forgotten’, and bans on biometricpowered photo tag suggestions – have left some wondering if privacy and IT are fundamentally at odds Technologists may be confused by these regulatory developments, and as a result, uncertain about their professional role in privacy management.

Several efforts are underway to improve technologists ‘contribution to privacy Most prominent is the Privacy by Design movement (PbD) A newer discipline of’ privacy engineering’ is also striving to emerge Yet a wide gap still separates the worlds of data privacy regulation and systems design Privacy is still not oft en framed in a way that engineers can relate to Instead, PbD's generalisations overlook essential differences between security and privacy, and at the same time, fail to pick up on substantive common ground, like the ‘Need to Know’ and the principle of Least Privilege.

There appears to be a systematic shortfall in the understanding that technologists and engineers collectively have of information privacy IT professionals routinely receive privacy training now, yet time and time again, technologists seem to misinterpret basic privacy principles, for example by exploiting personal information found in the ‘public domain’ as if data privacy principles do not apply there, or by creating personal information through Big Data processes, evidently with little or no restraint.

Engaging technologists in privacy is exacerbated by the many mixed messages which circulate about privacy, its relative importance, and purported social trends towards promiscuity or ‘publicness’ For decades, mass media headlines regularly announce the death of privacy When US legal scholars Samuel Warren and Louis Brandeis developed some of the world's first privacy jurisprudence in the 1880s, the social fabric was under threat from the new technologies of photography and the telegraph In time, computers became the big concern The cover of Newsweek magazine on 27 July 1970 featured a cartoon couple cowered by mainframe computers and communications technology, under the urgent upper case headline, ‘IS PRIVACY DEAD?’ .