In early May, the leak of a draft ruling to overturn the landmark Roe v. Wade sent shockwaves through the U.S. Though the legal precedent wasn’t officially overturned until June, female health application Flo wasted no time in response, designing and offering a feature to address the unanticipated, industry-wide issue affecting its U.S. users.
Working with global law firm Dechert, Flo created “Anonymous Mode,” a free feature that enables the app’s 48 million users to use its health services without personally identifying information.
Meanwhile, in the gaming space, video game developer King was looking for a way to get users engaged with its privacy notice. Alongside legal design agency Amurabi, King created a new experience for its millions of users — an interactive, engaging and accessible privacy notice mirrored after its games.
For their unique privacy and data protection services, Dechert and Amurabi and King received the 2022 IAPP Privacy Innovation Awards, for the Americas and EMEA/APAC regions, respectively. The Privacy Innovation Award is meant to distinguish operations that integrate privacy and elevate its value as a competitive differentiator and a centerpiece of trust.
‘A truly innovative move’
The Roe v. Wade decision accelerated development of Flo’s “Anonymous Mode,” which had already been underway, as users expressed concern over how third parties might be able to access and use their health data — for example, law enforcement using data to target prosecutions in states restricting or banning abortions.
Announced in June and launched in September, “Anonymous Mode” enables women to use the Flo app without being individually identified — deidentifying data, removing personal emails, names and technical identifiers.
Dechert advised Flo from inception to launch on the feature, Partner and Global co-Chair Privacy and Cybersecurity Brenda Sharton said. Having a user’s fertility history available, but not identifiable, while honoring Flo’s preservation obligations was a challenge, she said, one that required fresh thinking and an ability to quickly adapt. Through "Anonymous Mode" Flo does not delete personal identifying information from existing accounts, but rather, creates new accounts that contain all records from prior accounts — aside from personal identifying information.
“It’s a new and innovative feature for the app that addresses this new and unexpected challenge that the Dobbs decision presented for the company and the industry,” Sharton said. “It’s really an enormous and immediate response from the company trying to further protect user privacy … Given the tight time frame in overturning this decades-long precedent, Flo moved nimbly and quickly to provide this innovative solution with the help of Dechert.”
“Anonymous Mode” is offered as an option, not activated by default, since users will not be able to recover data on a lost, changed or stolen device once the feature is activated.
“This is an option for women to still have access to their fertility data and yet protect that data from being identified with them through company records,” Sharton said. “It really required fresh thinking and an ability to adapt to this unexpected news at groundbreaking speed.”
Sharton said the response to “Anonymous Mode” has been “extremely positive and she’s “so very proud” of Flo for the work in making it happen.
“To have a client that does the right thing by its users is an honor and a privilege," she said.
‘Make the world playful’
“Make the world playful.” That’s King’s motto. Senior Director, Legal and Data Protection Officer Willy Duhen, CIPP/E, CIPM, FIP, Amurabi’s founder and CEO Marie Potel-Saville, and members of their teams strove to bring this to reality through a document that might otherwise contain legalese and an overwhelming amount of difficult to digest information.
Together they created an interactive, engaging and accessible privacy notice that not only meets compliance obligations and informs users of their data uses and rights, but immerses users in King’s universe – mirroring the notice to the company’s games.
Users reading the privacy notice participate in an eye-catching game-like experience alongside some of King’s most iconic characters, unlocking legal points at each level that provide privacy information in easily digestible snippets. The policy covers the legally required topics in a privacy notice and includes the estimated time needed to complete each stage. Users can also jump to specific information they might be seeking.
“We’ve done something that is truly amazing and engaging. It validates our vision that we had for years and that we were able to materialize in a playful experience. We are at a time now that the legal and privacy world is changing towards consumer-friendly transparency. We are innovating for the industry,” Duhen said. “What I like is this could be imbedded into our games, and no one would see the difference between gameplay and the legal document. That might not work for another industry, of course. I think it’s up to everyone to find out what works for their audience and to make it work. Our goal was very much to merge the gaming and legal experience, so everything is unified and enjoyable for our players.”
Through user testing, King and Amurabi found replicating the gaming experience in the privacy notice was the most efficient way to improve audience engagement. A group of users were selected to create their ideal privacy notice and their insights were analyzed and implemented in the finished product. Testing showed improved understanding of and engagement with the interactive privacy notice over the original text, Potel-Saville and Duhen said.
“It’s empowering users to fully understand their privacy rights in an engaging way which looks like the experience they have when they play,” Potel-Saville said. “It’s really a way of equipping them with knowledge and tools so they can make enlightened, thus free decisions. That’s what we could call a ‘fair pattern,’ contributing to solving the privacy paradox.”
The team worked to understand where legal obligations under the EU General Data Protection Regulation, California privacy legislation and other regulations would sit alongside the best format to deliver clear, concise and digestible information for users in a fun way. The work was fun, and rewarding, Potel-Saville said, but also challenging.
“Turning the original document into plain language without betraying the original intent, saying the exact same thing because it’s a legal obligation, in a way that’s not just clearer but resonates with the brand identity and the tone of voice that King uses in their games — that was a ton of work,” Potel-Saville said, adding the wording was examined by a plain language expert.
Duhen said a large part of the success in making the privacy policy happen was the support of King’s leadership.
“I think we are very fortunate at King to have the mission to make the world playful, so when I discuss it with leadership and explain that’s what we're trying to achieve, then they get on board with the project, which is very important,” Duhen said. “Everyone at King is super proud of this.”
Innovation Award 2022 Finalists
Americas finalists for the 2022 IAPP Privacy Innovation Award are Privado's open-source “Privacy Code Scanner,” Private AI’s “privacy layer for software” redaction technology, and the Walgreens Boots Alliance’s “COVID-19 Index.”
Finalists in the EMEA/APAC regions are ERNIEAPP's privacy settings aggregator “The Privacy Knowledge Manager app,” ImmuniWeb SA’s “ImmuniWeb Community Edition,” and Statice’s “The Statice Anonymeter: Democratizing synthetic data privacy protection in enterprises.”
