By Jedidiah
Bracy, CIPP/E, CIPP/US
The Privacy
Advisor | Mar 16, 2015
Over the
course of two weeks for the iconic SXSW conference, Austin, TX, is filled with
a wide array of smart and engaging people, many of whom are building some of
the latest technologies, developing savvy new start-ups and working hard to get
those products and services out to market. New to many of those young start-ups
and fledgling companies is the idea that they need to implement privacy and
data security protections for their users.
With that
as a backdrop, some of the world’s top chief privacy officers (CPOs), who lead
privacy teams for some of the technology sector’s most established companies,
got together on Saturday to discuss how they are handling some of today’s most
pressing and complex privacy issues.
“We think
of people first,” said Facebook CPO Erin Egan. “We do that so we can build
trust.”
“Trust is a
key part of this,” agreed Microsoft CPO Brendon Lynch, CIPP/US. He explained
that he and his team constantly ask key questions during the product development
life cycle. Across the company, he added, the team has embedded “privacy
champions” who are generally perceived by other teams within Microsoft as
partners. And with a “dotted line” to the corporate office, Microsoft has
recognized that it’s important to get privacy right in the marketplace.
“As you try
to manage down privacy risk,” said Google Senior Privacy Counsel Keith Enright,
“all the legal and regulatory challenges can be difficult.” As a response, he
explained, Google looks for feedback from its users and works with other
experts within the company so that the privacy team can better understand the
technologies and issues others teams are working with. “We partner our folks
with experts in the mobile space or the wearable space, for example, so they
understand the unique things within those spaces.” That way, privacy
professionals within Google develop needed subject matter expertise.
Facebook’s
Egan added that it’s important to make sure your users know what they are doing
with their data when they post something and then, from there, build and
provide them with tools to help control how they use their data. In addition to
providing its users with an understanding of how they are using their data,
Egan said it’s also important to help educate policy-makers and regulators on
their products and services. “They’re the ones passing the laws,” she said,
“and they’re the ones regulating us, so it’s important to help them understand
how it works and the controls users have.”
And what
about regulators’ perceptions about privacy? Do they tend to care more about it
than consumers?
“Generally,
laws and regulations set a floor and not a ceiling,” explained Microsoft’s
Lynch. “Take individual perceptions of privacy as well. Some consumers care
very deeply about privacy, while others don’t care about it much at all. For
us, protecting privacy is beyond what the law requires. We try and anticipate
what their expectations are, and quite often, we find, consumers are more
demanding than the law.”
Google’s
Enright disagreed. “I think users want their products to work. They want them
to be efficient and they don’t want policies to disrupt that experience,"
Enright said. "In my experience, the regulations and laws often set up
hurdles and obligations that are way outside of the contemplation of our
users.”
Egan chimed in by noting, “Users want to
understand how to use our services. Regulators, however, are trying to imagine
scenarios and often set unrealistic expectations.”
IAPP
President and CEO Trevor Hughes, CIPP, pointed out that companies can often
comply with the law, but noted, “Just because it’s legal, it can still be
stupid.” He asked, “How can you gain authority within your organization when
the product and marketing teams want to do something stupid but purely legal?
In this ‘creepy’ area, where do you get that authority?”
Enright
said that is one of the great challenges in the early stages of an
organization, when it's trying to get its product or service to market quickly.
“It’s not difficult in my organization because we have been scrutinized so
much," he said. "We have not always done the best and we’ve made
mistakes, and we’ve felt the consequences of that. For us, user trust is
absolutely essential, and Larry Page recognizes we can’t get this wrong.”
As an
example, each of the panelists discussed how they dealt with major privacy
blows in the past. Specifically, Lynch talked about the privacy designs that
were embedded in the Xbox Kinect, an interactive gaming console that received
scrutiny for its facial-recognition features. He said, however, the company
began with Privacy by Design. “We didn’t need to store images on our servers,”
he said. Plus, the facial images were only points on a given face, so even if
the data had been accessed by a bad actor, it would make no sense. The
biometric data was also stored locally and deleted after the given session ended.
But, Lynch asked, “How do you teach consumers
how the privacy protections are working?”
There are
multiple ways to achieve that, he explained: Provide a user interface to
explain the uses to consumers. Plus, build a FAQ page that explains user controls
and drives people there. Finally, he added, engage external stakeholders and
talk with consumer groups and regulators to help mitigate misunderstandings.
Looking
forward, Enright said it will be important for companies to give users more
controls, noting, “They can be empowered with the data about them.”
Facebook’s
Egan agreed. “I hope," she said, "to see more control at the center
of people and for them to have more control of their information.”
Lynch,
however, offered a different perspective. “There’s so much information out
there," he said, "much of it with predictive capabilities, and with
that, there needs to be more discussions about the ethical uses of personal
data. We need more systematic approaches to privacy rather than placing the
onus on the individual.”
Really,
whether society goes to a more use-based or collection-based model, it will be
many of the young entrepreneurs here at SXSW who will play a large role in
determining these outcomes. Established companies like Google, Facebook and
Microsoft have learned their lessons the hard way. The question remains, then,
whether these younger companies will learn these lessons the hard way, too.
