Privacy by Design (PbD) is a concept that governs the way in which personal data is collected, stored and used. It speaks to both technical and organisational requirements.
Any software or process that is created in line with it should adhere to strict principles that prioritise the rights of the individual to control access to their own data.
For digital marketers who operate within the jurisdiction of GDPR, CCPA or under other consumer data legislation, Privacy by Design is now a fundamental requirement for the campaigns they run and the software they use to facilitate them.
Even those marketers and organisations who currently are not governed by strict laws would do well to take these principles to heart. A successful mobile marketing strategy, built on strong customer relationships, should be in line with them.
What are the principles of Privacy by Design?
There are seven fundamental principles of PbD, as listed below;
- Proactive not Reactive; Preventative not Remedial
- Privacy as the Default
- Privacy Embedded into Design
- Full Functionality – Positive-Sum, not Zero-Sum
- End-to-End Security – Lifecycle Protection
- Visibility and Transparency
- Respect for User Privacy
Let’s quickly unpack them, for clarity’s sake.
Proactive not Reactive; Preventative not Remedial
Your data-protection strategy should set out to prevent breaches or failures in the first instance. There should be a concerted effort to implement frameworks and proactively improve processes. Alignment across all departments and stakeholders is also expected.
Privacy as the Default
It should be assumed that unless otherwise instructed, the user wants their data to remain private. Any and all usages of requested data should be clearly stated at the outset and respected.
Privacy Embedded into Design
Basically, what this is saying is that Privacy by Design cannot be an afterthought; it should be central to all technical and organisational systems. It also means that any software your organisation uses should be vetted to ensure it does not jeopardise your own integrity. A Data Privacy Impact Assessment should be carried out ahead of each new project or addition to your tech-stack.
Full Functionality – Positive-Sum, not Zero-Sum
Safeguarding the privacy rights of your customers does not have to come at the expense of growth and revenue. However, privacy cannot be compromised in favour of these things either!
Privacy by design is also more than a simple list of objectives. There should be clearly identifiable metrics and goals in place to quantify success.
End-to-End Security – Lifecycle Protection
This is a “cradle to grave” security procedure, protecting data throughout its lifecycle. From the point of collection (through whatever means it may be) to the point of destruction, you bear responsibility for keeping it safe.
Visibility and Transparency
Are your data protection policies documented and available upon request? They should be!
The rule of thumb here is accountability. If you are collecting and storing data then you need to accept responsibility for it.
Respect for User Privacy
This is really what it all boils down; genuinely respecting user data as though it were your own.
Consent is essential. And the more sensitive the nature of the specific data is then the more explicit you need to be when asking for it. The user has the right to request a summary of the data that you have on them and to have it deleted if they so choose. It doesn’t matter if they have previously given consent, once they want it gone then you are obliged to get rid of it (and safely too!)
Criticism of Privacy by Design
Privacy by Design is not without its critics. The biggest argument against it is that it’s vague and difficult to implement in a practical way. Whilst this criticism is true, it misses the point; the Privacy by Design code is not a how-to. It is intended to guide organisations, not prescribe the nitty-gritty steps they should take.
What does Privacy by Design look like in action?
Ok, so knowing the principles is one thing but how do they actually affect your organisation’s day to day campaigns and processes? Let’s look at PbD from a practical point of view.
- Campaign design and execution
The legislation has been worded to include any instance of acting in bad faith, where a company might seek to trick a customer into handing over more information or permission than they realise.
Firstly, marketing permissions cannot be bundled with other services or requests. They must be separate and clearly flagged.
Sign-up forms and boxes cannot be pre-ticked for consent, either. The user must actively opt-in.
Permission is not permanent; the user has to the right to rescind it at any time. As well as making this known to the user at the point of consent, you must also detail how they can go about it.
- Data acquisition
How are you actually acquiring the data in the first place?.
Be very wary of third-party data, whether bought or received through a data-sharing agreement. It is still your responsibility to ensure that the data has been acquired legally and in good faith. Has the user given consent for this data to be shared with you? Make sure you investigate the companies that you associate with.
- Data security
Any company that is handling private data needs to be certain of their data security framework. Data should really be encrypted at all points, in transit (input and output) and at rest.
At Xtremepush, this is something we take very seriously. We have a Data Protection Officer who oversees compliance across the platform. We also have implemented a robust user management system, allowing our clients strict control over what individual team members can and cannot access.
- Data storage & hosting
There are a couple of aspects to this. Firstly, the user must be able to access the information you have stored on them too. They also have a right to ensure its accuracy. So if they ask you to update anything, then you are obliged to do so!
When working with service providers, you also need to be clear about where they are storing any of the data you send them. If you are operating in a GDPR region, but your data is stored elsewhere there may be issues. Ideally, a service provider should be able to deploy a private cloud, if needed, in any region you require.
Disclaimer: This article does not constitute legal advice.
Writing an RFP for a Mobile Marketing Platform?
Download our free guide to learn the key questions you need to ask.