10 Little Privacy Recipes
By: Laurent Cerveau
Tags: Cto, Privacy, Regulation, Gdpr Compliance, Gdpr

Dealing with privacy issues, and in particular the implementation of GDPR, has been an important part of my previous job as CTO. In all truthfulness this is the kind of topic that at first nobody really wants to deal with, … at least if you’re not a lawyer. It turns out the subject is deeper than it appears as it mixes various components: legal of course, but also technical, product, cultural… and a dose of personal judgement. Not to say that I would read a book about GDPR in my free time, but there is definitely enough here to tickle anyone interested in “many things”.

Of course when a topic has to be tackled, a natural tendency is to browse the Internet for a “10 recipes to deal with something annoying, be OK and go back to having fun in my beloved area” article. But in 2018, those were mainly summaries and rehashes of the regulations (and some were useful!), and time was needed to bring more perspective. Also regulations are themselves not always black or white with clear applicable and simple rules, and over time they turn into somewhat pragmatic steps.

Context also plays a role. The approach may not be the same depending on the type of company you’re working for (your type of customers, the targeted countries, the domain of the company…). So before you blindly follow those recipes, stop and think if it applies to you.

Rule 1: don’t let a lawyer write all your legal documents

This one may sound counter intuitive, but look at it this way: do you read all Privacy Policies and legal documents of any platform? My bet is no, and one of the reasons is because they are written in a way that makes you sleep at the end of the first line. So team up with your lawyer (who usually also loves when it’s clear for everyone, I worked with a fantastic lawyer!) and make sure every word will be understood by both of you. Your users will have a similar reaction.

Rule 2: don’t do what you would not accept

Have you ever heard these arguments when it comes to having the user consent to the use of their data: “But if we ask for consent, nobody will accept it: can we bury this in the Privacy Policy? After all, the feature will be so useful to them that it is a shame to have to ask for consent”. Somehow this does not sound completely right. If you know the majority will likely refuse to provide consent, then maybe you should ask yourself if the feature is properly prepared. Is it really needed for the product? Is it really useful and with clear and good explanations? Would you really use it yourself, beyond the hype effect? If the answer is always yes, then there should be no problem in finding an honest and clear solution.

Rule 3: imprint the notion of personal data in the head of everyone

Repeat after me: personal data includes data that can directly or indirectly identify a person. The famous “indirectly” that can cause so much confusion… Approach it simply: if matching the data with other data — publicly available or not — could give a hint on “who this user is” then it’s personal. If not, and you are in the position to demonstrate it’s truly anonymous, then all should be fine. So an obscure and anonymous unique identifier generated by your platform can be OK to manipulate and/or transmit to third parties (and in fact you should transmit only those to third parties like analytics companies). Now if having one of those identifiers publicly available can lead to issues, then maybe you should seriously think about hiring a security expert…

Rule 4: question every data path when working with third parties.

This is a well known scenario: you have to rely on a third party for a feature. Of course, their business developer will tell you that they are GDPR compliant (if you can find someone advertising the fact that they are NOT GDPR compliant, then praise their honesty but still leave). But never be happy with this simple answer and question: question every usage, question every data path, question every processing. Especially in the “cross-app world” (i.e. advertising, especially with so-called “self reporting networks”), nothing is really magic. Somehow, something that can identify you is likely circulating. And sometimes it may not even answer your needs as a company and is just the easy path for the ad company!

Rule 5: don’t spend your energy questioning the regulations.

Sure at the end of the party, it can be nice to have some drunk discussion about the fact that phone numbers and IP addresses aren’t really personal data, as both can be recycled. But they are: period. And you should not waste time discussing it, or start a lament about the fact that “the old companies” had it “easy” (that is “not caring at all”) while “things are more complex Today” and “somehow it really hurts the product and the freedom of users” (this is the ultimate BS argument…).

There is GDPR, there is California Data Protection Act, South Korea is doing something and other regulations are in the works. There will be more, and this is where the world goes. Like for everything, there may be turmoils, back and forths but the winner will be the first one to accept, understand, digest and play the rules like a Zen Master.

Rule 6: let them go!

If users want to leave, let them go! The easier it is, the better for everyone. Don’t spend time doing the “give us some feedback, we are a startup 2.0” ridiculous and annoying dance. Make it easy, visible, clear and give them a grace period. And if they come back during this period make them aware that they may think twice before proceeding, instead of resubscribing them right away assuming they desperately wanted to come back. Leaving users will praise you for this!

Rule 7: let them go (again and technically)!

The following happens usually after a big talk where everyone agrees about being privacy safe; someone suddenly says “we can’t delete the data, it could break everything; we may not even know which table contains those data and this is a danger for us. We can’t put the production in danger, it is so fragile, this can cost millions!”. Guess what: this is why many companies suffered with GDPR: digging into their own technical weaknesses assuming they could keep everything forever. Just having the thinking of “deletion” at the beginning of each new feature will make this problem nearly vanish.

Rule 8: pseudonymize/pre-anynomize everything, TTL the rest (except in one place of course)

Data that will be hard to delete must be stored in a “ready to be anonymized way”. Deletion will then simply be a problem of removing magic keys and links that make them relevant. This requires pre-thinking of usage, the building of a dedicated data pipeline, and knowledge of concepts like pseudonymisation and anonymization techniques. But it’s better to integrate this in the whole processing chain than to deal with it “only at the end when needed”. And for temporary items, always store them with a TTL that corresponds to your company’s retention policy so they disappear automatically.

Rule 9: never forget you’re biased by your culture

If you’re European (especially French), the enemies are big bad (American) corporations. If you’re American, the enemy is the State. And the list goes on. Your own culture and education will lead to a bias in the handling of such topics. and make you consider some behaviours as “acceptable” especially when they are handy. For example everybody finds it cool when a car insurance company is telling you that “it will automatically transfer your policy from your previous insurance company” without realizing that they may just transmit elements of your driving life that you thought had disappeared from your records and that now haunt you forever. Getting to know the cultural differences among your users is essential.

Rule 10: don’t overdo things

We all know there is a need for cookie banners on websites. But if your website is simply a redirect to the store pages of your mobile app and you use the most anonymous form of Google Analytics to get a global visit stat, maybe this banner is not required, no? Finding the right balance and keeping it clear is your job and not only will it make a better user experience but it will be closer to the regulation. Being “privacy paranoid” is certainly not incompatible with preventing it from being an everyday headache.