Pbd

Jared Kaprove

Ann Cavoukian is a rare breed — a government official working with privacy and technology who genuinely seems to understand both. In Privacy By Design, the current Information and Privacy Commissioner of Ontario Canada proves it. Dr. Cavoukian’s recent work compiles a number of reports, guidelines, speeches, and essays published by her and her office in recent years. These various pieces combine to show a comprehensive approach to privacy in a modern world.

Dr. Cavoukian’s work over the last twenty years has been a steady evolution of ideas. In 1995, she promoted Privacy-Enhancing Technologies (PETs) with the Netherlands Data Protection Authority. This term has been instrumental in guaranteeing the continued presence of privacy protections by building them into technology. Later in the decade, she argued for the concept of “privacy by design,” a philosophy in which privacy is embedded into the technology itself during development, such that privacy and data protection become part of designers’ original goals. While this view has become more prominent, Dr. Cavoukian was instrumental in its adoption.

In her current work, Dr. Cavoukian expands her idea of PETs into a new concept, which she calls “PETs Plus.” This concept is the idea that privacy need not be part of a zero-sum model, in which increasing privacy comes at a cost to efficacy. Instead, Cavoukian argues for a positive-sum model, in which privacy can be increased alongside security, or alongside business practices, so that focusing on data protection has only net benefits for designers and implementers of technology.

Many of the essays in Privacy by Design include examples of these PETs Plus, and many of them are quite impressive. In her discussion of CCTV, Dr. Cavoukian describes a new development in which people’s images in the video stream are encrypted. This allows a person to monitor the video live for suspicious behavior without ever seeing anyone’s identity. If the video contains evidence of a crime, proper law enforcement officials can decrypt that section, with a suitable audit trail ensuring that only the necessary information is decrypted.

Another excellent PET Plus is a design from IBM for radio frequency identification (RFID) tags that can be disabled or even reprogrammed by the consumer, which would allow the tags to be useful in inventory and sales management, while giving individuals the ability to decide exactly how they will be used at home. Dr. Cavoukian also discusses an advanced method for securing and encrypting biometric authentication systems, and privacy-maximizing best practices for a number of security processes, including CCTV, RFID in healthcare, and airport searches. Privacy By Design is a must-read for anyone in the security or privacy fields looking for the best approach to new technology.