IEEE Consumer Electronics Magazine - March/April 2020 - 84

Special Section on Privacy and Security by Design

not only find such an approach as PbD invasive
but they would insist (albeit with some historic
validity) that they themselves developed the
concept first!
Indeed, the development of PbD in 1995 is
intriguingly coincidental with the work of
another, the computer scientist, Dr. Kim
Cameron. A longtime Microsoft engineer, leader
of the company's legendary, US-based identity
management lab and the author of the seminal
"laws of identity," Dr. Cameron's practice principles defined user-centric computer science
beginning in the early 1990s. He retired in 2011
as a Microsoft Distinguished Engineer and Chief
Architect of Identity, some might argue, a status
he could rightly claim for the entire world not
just for a single company such as Microsoft.
But it is a distraction to quarrel over who
developed PbD originally. Because Microsoft
seemed uninterested in broadly promoting PbD;
or, even promoting such work outside of Microsoft's own identity lab where they could channel
it more directly, exclusively (and profitably) into
their own products.
Dr. Cavoukian's skill was less ideation (creating the concept) and more evangelism (promoting the concept): she was less interested in
outright ownership of PbD and more excited
about spreading the approach far and wide for
every IT engineer to adopt. That's why her name
is more overtly synonymous today with the concept of PbD than that of Dr. Cameron, as distinguished an innovator as he was and still is. For
her part, Dr. Cavoukian continues to evangelize
PbD in her capacity as Founder of the Global Privacy and Security by Design Centre in Toronto.

NO TIME LIKE THE PRESENT
This evangelism has paid impressive dividends. After Cavoukian's office (OIPC) first published first published "Privacy by Design:
Essential for Organizational Accountability and
Strong Business Practices" in 2009, the DPAs of
the world endorsed PbD at their next annual
gathering, the International Conference of Data
Protection and Privacy Commissioners held in
Jerusalem in June, 2010. Even more impressive,
the European Commission and Parliament -in
addition to all 28 EU member states- codified

PbD as a requirement within the landmark European General Data Protection Regulation (GDPR)
which went into force in May, 2018.
Today's environment could not be more ripe
for PbD. Information technology (AI in particular), Internet content, digital media, and cloudbased services all define data-driven innovation.
And the "digital transformation" that every leading business consultancy espouses so enthusiastically has only heightened the expectations not
just of technology clients but of more traditional
companies that are not in the "data business" at
all. Now, these companies are impulsively, if
somewhat reluctantly, examining their "data"
and "data value" as core assets even if these
were never before part of their product or service portfolio.
If you collect consumer data as an input to
your product, not just as a feature or core component, but as a basis for understanding who
your customer is, you have essentially become a
data-driven business. In this sense, every business today is a data-driven business.
Data-driven businesses have also become the
target of -if not the source for-the vast majority of public anxieties over corporate privacy
practices. High-profile breach incidents such as
Facebook/Cambridge Analytica in 2015 and Equifax in 2018 further exacerbated the public anxiety already building across North America (and
beyond) that companies are not sufficiently protecting consumer data.
It is precisely because today's environment is
so data-driven that PbD has become especially
relevant and urgently needed. More so even
than at the time of PbD's conceptualization
(1995) or its regulatory embrace (2009). So much
more that PbD itself now begs for an even
broader context. Yes, in the most ironic twist,
PbD now finds itself as the entity with the undue
burden: it needs other efforts to bolster the privacy protection it was created to help address.

MOVING FROM PbD TO PRIVACY IS
CULTURE (PiC)
Fortunately, the remedy for PbD's undue burden is quite simple in concept if intimidating in
scale. The remedy is a broadening of the definition of privacy itself.

IEEE Consumer Electronics Magazine

IEEE Consumer Electronics Magazine - March/April 2020

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - March/April 2020