# How to Build Organisations for Privacy-Friendly Solutions

Christian Buggedei

<figure><img src="image_1.png" /></figure>

## To cite this version:

Christian Buggedei. How to Build Organisations for Privacy-Friendly Solutions. 17th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Aug 2022, Virtual, Germany. pp.3-7, 10.1007/978-3-031-31971-6_1. hal-05315951

HAL Id: hal-05315951

https://inria.hal.science/hal-05315951v1

Submitted on 15 Oct 2025

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_3.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# How to Build Organisations for Privacy-Friendly Solutions

Christian Buggedei(✉)✉

Polypoly Enterprise GmbH, Hamburg, Germany

christian@buggedei.de

https://www.buggedei.de

**Abstract.** Personal data is a central corner stone of a broad variety of business models. But collecting and keeping this kind of data is risky and expensive for organisations, and potentially incorporates privacy risks for persons whose personal data is processed. This tension between risks and benefits is investigated with a focus on organisational aspects based on the perspective of the startup polypoly. The main focus is to split up the organisation to avoid conflicting interests.

This paper summarizes a keynote speech held on this topic at the 17th IFIP Summer School on Privacy and Identity Management.

**Keywords:** data protection · organisational security · privacy risk mitigation

## 1 Introduction

Nearly every organisation has to deal with the processing of personal data these days. Especially recently founded organisations and startup companies with data-centric business models typically have the processing of personal data as a central element. Examples are delivery services that focus on managing routes and personal habits of their drivers, nonprofit organisations that try to address individual small-scale donor, or streaming services that focus on giving recommendations based on personal preferences.

Processing of personal data is thus one of the corner stones of modern organisations. To address privacy risks from the point of view of the organisation typically a broad range of technical and organisational measurements are employed. The present case study demonstrates how the startup company polypoly addresses privacy risks and derives short and long time mitigation measurements with a focus on organisational measurements.

## 2 Challenges for Organisations

The central assumption of organisations is that personal data, and processing it according to legal regulations for various commercial and non-commercial

<footnote>The author worked as Senior Product Owner at polypoly.</footnote>

<footnote>© IFIP International Federation for Information Processing 2023</footnote>

<footnote>Published by Springer Nature Switzerland AG 2023</footnote>

<footnote>F. Bieker et al. (Eds.): Privacy and Identity 2022, IFIP AICT 671, pp. 3–7, 2023.</footnote>

<footnote>https://doi.org/10.1007/978-3-031-31971-6_1</footnote>
purposes is in general positive. Of course, there are also a lot of use cases which are at least ethically questionable, but stopping the collection, processing and especially analysis of personal data altogether for that reason is cutting off our nose to spite our face.

If we want a media recommendation algorithm to work for us, it needs to know our preferences. Ensuring that a new prescription is compatible with our genetic preposition or has no contraindication with medication we already take needs access to our medical history.

Data is good, but there are inherent risks for it to be exploited for ethically questionable purposes. If an organisation works with data, it needs to prevent these exploits. To this end, we need to delve into a few topics:

## 2.1 Security as Baseline for Privacy

An important baseline to address privacy risks from the point of view of a company is an adequate level of security. Security and security practices in this context mean that the company is addressing security risks with adequate measurements such that no unauthorized or unintended entities can access the collected and processed personal data. This area is already widely covered by research and best practices. Standard practices include measurements as encryption, strong access control, network and operational security, audits, and so on.

It is important to keep in mind that good security needs to keep external attackers (malicious hackers for example) at bay as well as address internal weaknesses: Overwhelmed system administrators can make mistakes or authorized personnel could be targeted by phishing or advanced persistent threats.

Still, many organisations, especially recently founded ones, tend to underestimate the effort and scope of the task to secure data correctly.

## 2.2 Future Developments and Legal Regulations

Even if one has managed to create a good security infrastructure, there are ways that others can still exploit the data an organisation has collected. This could come in the form of a coercive government, a corporate buy-out, lawsuits - or even blackmail. Especially governments, law enforcement agencies and regulators could demand access to data based on legal regulations. Securing data is thus not only a technical challenge, but also a legal and organisational one.

In addition future developments need to be taken into account. There might be changes in the management and leadership of the organisation and organisations might face economic challenges. This might change business models and policies concerning the use of personal data. Also in the context of bankruptcy proceedings infrastructure of the organisation and thus also data might be sold to the highest bidder. In the context of policies for the processing and use of personal data, it is vital to consider such future scenarios.

## 2.3 Implications of Business Models

As Andrew Lewis wrote on Metafilter [1]: "If you are not paying for it, you're not the customer; you're the product being sold." An important question is how an
organisation is funded. Funding usually comes with conditions attached, either explicitly or by the threat that it could be revoked at some future point in time.

Funding has a strong influence on the priorities concerning the use of data. A company that is financed through advertising for example will ultimately cave in to their advertisers demands. If one is funded by subscription fees of the users whose data is stored, they are the primary stakeholders. It is important to consider these potentially competing interests.

## 2.4 Cost of Data

Collecting and storing data is surprisingly expensive [2], even though the costs for computers and storage space have comparatively plummeted over the decades. But the amount of data we can easily collect has also increased significantly over time, and keeping it available for computations means that one cannot use the cheapest storage options.

Additionally, storing and processing data also means the cost of securing data, maintaining backups, factoring in possible fines for privacy violations, the costs for audits, mandatory data protection staff, and so on. When a huge amount of data from different sources is collected, organisations tend to lose track of what they have [3].

# 3 Tactics for Privacy-Friendly Organisations

In order to address the challenges described above, organisations should address the following tactics in their strategy. Since data is in general expensive, organisations should try to get rid of data and of conflicting interests. In addition, they should ensure that privacy is the cheapest option and the data subjects have the ultimate decision power over their data.

**Pay the Piper, Order the Tune:** Every organisation is ultimately beholden to those who finance them. Hence every organisation should strive to be financed by those whose interests they want to be most beholden to. When at any point an organisation realises to have competing interests, a valid option is to split up, to maintain integrity. In the following general considerations for organisations are summarized.

**Plan for the Future:** It cannot reliably foreseen what impact the future could have on personal data and the corresponding safeguards in the organisation. As a result, responsible data handling needs to take that into account and strive not to keep data for long periods of time. An even better option, considering the cost, is to avoid collecting data or delete data as soon as possible.

**Make Privacy the Cheaper Option:** If privacy depends on budgets, it is always in peril. But if privacy saves money, it is always the preferred option.
**Empower Your Users:** Once it is processed in a service of an organisation, end users have only legal recourse when it comes to data protection, but very little actual power over the data. Even the best practices rely mostly on informed consent. In many cases this consent choice is presented as all-or-nothing. Empowering the end users means that they need to have direct control over their data and have a true and meaningful choice when asked for consent.

# 4 Case Study Polypoly

The data privacy infrastructure startup polypoly strives to employ these tactics and to enable users to assert their right to privacy. Central elements are a service architecture ensuring that access to personal data cannot be gained without knowledge and consent of the data subjects. To prevent conflicts of interest, polypoly split up into different entities.

## 4.1 Organisational Structure - Splitting up in Different Entities

Despite the fact that this comes with overhead and organisational complexity, polypoly decided from the start that the organisation needs to be split up into three different entities, namely the cooperative, the foundation and the enterprise, each with its own area of responsibility and its own stakeholders.

None of these entities collects, stores or sells private data. The business relationship is between citizens and businesses. polypoly as a company only provides the platform, infrastructure and information for a user-centric data economy.

**Cooperative:** The Cooperative is financed and owned by its users which are European citizens. This entity builds and provides the Edge Data Ecosystem platform "the polyPod" enabling users to own, control and monetize their data themselves. The technical service polyPod is described in Sect. 4.2.

**Enterprise:** The Enterprise is financed and owned by business investors. Its task is to develop and operate software and services that enable companies to use and provide data-based services.

**Foundation:** The Foundation is created as a market neutral actor and funded by donations. It provides checks and balances for the ecosystem by making data flows transparent. Participants in the edge data ecosystem use this information to make self-determined decisions about the handling of data.

## 4.2 Service Architecture - The PolyPod

Since the compute resources available in smartphones are considerable, they can be used for data analysis. The central idea of the mobile and desktop app polyPod is to keep the data on the smartphone of the user and analyse it locally
instead of transferring it to a central service. Hence personal data remains under the control of the data subject. This allows users control over their personal data and can be used as an important building block to realize privacy by default

# 5 Conclusion

Based on the tactics described above privacy of users can be ensured for the long term. This can be considered as important building blocks for a privacy by default strategy for data-driven services. Companies and organisations on the other hand can minimise the costs and efforts of data protection without actually compromising security. Cloud to Edge connectors allow for an integration into existing systems.

# References

1. Andrew Lewis, Metafilter. https://www.metafilter.com/95152/Userdriven-discontent#3256046. Last Accessed 06 Nov 2022

2. Statista, AWS costs. https://www.statista.com/statistics/250520/forecast-of-amazon-web-services-revenue/. Accessed 06 Nov 2022

3. Facebook, Internal Facebook document written by Facebook privacy engineers about the company's challenges dealing with user data and privacy regulations. https://www documentcloud.org/documents/21716382-facebook-data-lineage-internal-document/. Accessed 06 Nov 2022