<!-- wp:paragraph -->
<p>by MC PÉROUX, LL. M January 14, 2019 </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p> <strong>WHY PRIVACY BY DESIGN UNDER THE GDPR IS IMPORTANT FOR COMPANIES 1 </strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>A QUICK RECAP OF THE 7 FOUNDATIONAL PRINCIPLES 2<br>
They have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>for the first time, a mandatory legal text has included its tenets, the GDPR.
1. Proactive not Reactive; Preventative not Remedial
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>è purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>2. PrivacyastheDefaultSetting
3. Privacy Embedded into Design
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>è GDPR, art 25
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>4. FullFunctionality-Positive-Sum,notZero-Sum<br> “Privacy by Design avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both. “ 3 </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>è See the current discussions on different business models of free information services
accessibility without a paywall (personal information given of exchange of free
information) 4
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>1 More details on PBD “Privacy and security by design, data security, and GDPR compliance “,
MC Péroux, dec.12, 2018 on LinkedIn
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>“ https://www.linkedin.com/pulse/privacy-security-design-data-gdpr-compliance-marie-
claire-p%C3%A9roux/<br>
2 Privacy By Design The 7 Foundational Principles- January 2011 https://www.ipc.on.ca/wp-
content/uploads/resources/7foundationalprinciples.pdf<br>
3 Ibid.<br>
4 “Austrian DPA Issues Decision on Validity of Cookie Consent Solution“ , Hunton Andrews
Kurth LLP, Posted on January 7, 2019,
https://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validity-
of-cookie-consent-solution/<br>
“The differing approaches taken by the Austrian DPA and the UK ICO demonstrates a
lack of alignment on this issue, and it remains to be seen how other DPAs will decide
on the issue “
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>1
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>5. End-to-End Security - Full Lifecycle Protection<br>
è GDPR: art 5-1 f), art 25 and art 32 (“ level of security appropriate to the risk “)
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>6. VisibilityandTransparency-KeepitOpen
è Accountability, GDPR art 5-2, art12
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>7. RespectforUserPrivacy-KeepitUser-Centric<br>
è Accuracy GDPR art 5-1 d), Rights of the Data Subjects, GDPR Chapter III
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>WHY SHOULD COMPANIES REALISE THE IMPORTANCE OF PRIVACY BY DESIGN ?
The GDPR introduces a change in paradigm.
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It is not centered on the processors but on the individuals’ fundamental rights. 5<br>
The gauge to assess an envisaged personal treatment remains the risk it represents to the
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>data subjects’ fundamental rights, the right to privacy being one of them.
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>NO RIGHT IS ABSOLUTE AND THE GDPR IS A BALANCING ACT BETWEEN THE RIGHT TO
PRIVACY AND OTHER RIGHTS
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>See the current issue on the right to erasure (art 17) where the CJEU Attorney General, M.
Maciej Szpunar, recommends a limitation of this rights balancing it with the right to
information:
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>§57 “ En revanche, et c’est en quelque sorte le nœud de la présente affaire, le<br>
« droit à l’oubli » doit être mis en balance avec d’autres droits fondamentaux. “ 6
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>When designing any process on personal data the very first question of the processor should
be “do I respect and embed the fundamental rights of the persons when I use their personal
data? “
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>5 Charter of Fundamental Rights of the European Union, art 8(1)
</p>
<!-- /wp:paragraph -->

<!-- wp:embed {"url":"http://www.europarl.europa.eu/charter/pdf/text_en.pdf"} -->
<figure class="wp-block-embed"><div class="wp-block-embed__wrapper">
http://www.europarl.europa.eu/charter/pdf/text_en.pdf
</div></figure>
<!-- /wp:embed -->

<!-- wp:paragraph -->
<p>6 In French, Conclusions de l’avocat général M. Maciej Szpunar présentées le 10 janvier 2019,
Affaire C-507/17, Google LLC, venant aux droits de Google Inc. Contre Commission
nationale de l’informatique et des libertés (CNIL),
http://curia.europa.eu/juris/celex.jsf?celex=62017CC0507&amp;lang1=fr&amp;lang2=EN&amp;type=TXT
&amp;ancre=
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>2
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>I know this is still too rare an attitude especially among the internet personal data giants like
the (in)famous GAFAM 7.<br>
Their entire business model is based on the gathering of as much personal data (under the
GDPR extensive definition) as possible with too often very deceptive opaque methods.
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>NEW TRENDS AMONG COMPANIES PROCESSING PERSONAL DATA
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Some companies, more forward looking, realise that the users, real persons with real interest
in protecting their physical life from intrusive data hogging methods, demand that something
has to change in the handling of their private information.
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>They have perhaps understood the general move towards more respect for the individuals’
privacy.
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Look at the legal trend towards the respect of private information from the upcoming
Californian Legislation 8, the success of Convention108 in bringing privacy considerations
into many jurisdictions 9, even the president of Apple, Tim Cook, is asking for a legislation on
privacy 10
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>At the recent 2019 edition of the CES, privacy made an entrance but it remains to be seen
whether the companies do really apply Privacy By Design or if they are just surfing on the
trends.
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>7 GOOGLE, AMAZON, FACEBOOK, APPLE, MICROSOFT<br>
8 AB-375 Privacy: personal information: businesses. (2017-2018), Assembly Bill No. 375
CHAPTER 55, An act to add Title 1.81.5 (commencing with Section 1798.100) to Part 4 of
Division 3 of the Civil Code, relating to privacy. [Approved by Governor June 28, 2018. Filed
with Secretary of State June 28, 2018.]
https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375<br>
9 Convention for the Protection of Individuals with regard to Automatic Processing of
Personal Data, Strasbourg, 28.I.1981, “This Convention is the first binding international
instrument which protects the individual against abuses which may accompany the collection
and processing of personal data and which seeks to regulate at the same time the
transfrontier flow of personal data. “ https://www.coe.int/fr/web/conventions/full-list/-
/conventions/rms/0900001680078b37<br>
10 “This Is Surveillance.' Apple CEO Tim Cook Slams Tech Rivals Over Data Collection“ “
Cook also reiterated calls for federal privacy laws in the U.S., similar to those unveiled in
Europe, called the General Data Protection Regulation.“ Natalia Drozdiak and Stephanie
Bodoni / Bloomberg October 24, 2018 via TIME, http://time.com/5433499/tim-cook-
apple-data-privacy/
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>3
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Too often, companies with a business model based on processing personal data or selling
software allowing it, announce that they are “100% GDPR compliant “ but when one looks
more into the process they use, it is clear that the GDPR principles have been overlooked or
interpreted wrongly... 11
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>On the other end of the spectrum, one finds even some American companies that
communicate on privacy as a feature embedded from the start in their business model.
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>For example:<br>
Info: I have no affiliation, no interest in the companies, I do not endorse their products
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>èHUMU12<br>
Although I do not like behavioural analysis in general, finding it extremely invasive on privacy,
this company’s communication seems ahead of others on Privacy By Design<br>
“That’s why we built with the GDPR in mind from day one, and we extend the rights from the
GDPR to every user no matter where in the world they live. This includes transparency,
control, and data portability. “ 13
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>èSNIPS14<br>
“Snips Global Communications Director Genia Shipova said the focus on privacy by design is
what makes Snips a GDPR-friendly solution. » She said Snips wants to avoid data-centric
business models used by larger tech companies by focusing on contracts with its
customers.“ 15
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>èQ-BranchLabs16 andtheirVektor17 product<br>
" We start with the assumption that everything we send out of this device has to be GDPR-
cleared. We just don't want to deal with the problems. All of the logs and security alerts that
we send out, we still rip out all of the private information." Says the founder Jim McCoy 18
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>11 An example among many “How did we get here? “Twitter feed @_gaeel_
https://twitter.com/_gaeel_/status/1082702284746883072<br>
12 https://humu.com/<br>
13 “Data Privacy at Humu: Building Systems for Trust to Make Work Better “, January 9,
2019, Bryan Zimmer https://humu.com/2019/01/09/humu-data-privacy-trust-iso-soc/
14 https://snips.ai/
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>15 “CES 2019: GDPR talk fills halls of Eureka Park “, Ryan Chiavetta, CIPP/US, Jan.9, 2019,
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>https://iapp.org/news/a/ces-2019-gdpr-talk-fills-halls-of-eureka-park/
16 https://www.q-branch.net/index_d/<br>
17 https://getvektor.com/<br>
18 Above note 15
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>4
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>è OEKON SAS and its device ASK-HARROLD 19 developed in France
Based on an AI that searches for you information on Internet
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>CONCLUSION
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>I hope that companies realise how important it is to understand the principles to protect and
respect the ever-growing mass of personal data they handle. They could start reading Art 5
of the GDPR relating to its founding principles.
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>To respect Privacy By Design is just to respect the persons at the end of the process.
</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>
							Maybe by showing respect, some companies could even gain trust from their
customers.

						</li><li>
							Place yourself in the shoes of the person when you design any personal data
treatment.

						</li><li>
							Imagine that this person is someone important to you and see how it really feels to
you that her personal data, her life, is processed by your envisaged treatment.

						</li><li>
							Educate the developers to the values of privacy during their studies.

						</li><li>
							Hire people who understand the value of their own privacy to develop your processes.

							Yes business is important but ethics, respect should not be lost.

							A person who trusts a company’s handling of her data will give the information needed, it is
a trust that companies should gain, not steel away by opaque processes and algorithms.

							MC PÉROUX, LL. M<br>
Blog in French to SMB’s to understand privacy https://mementosafe.com/
LinkedIn<br>
Twitter

						</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>19 http://minim-e.com/ and https://play.google.com/store/apps/details?id=fr.oekon.harold
https://itunes.apple.com/us/app/ask-harold/id1332599364
</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>5
</p>
<!-- /wp:paragraph -->