In the wake of the recent Facebook and Cambridge Analytica revelations, privacy professionals may be wondering what this means for the privacy industry. Many privacy pros are probably grappling with how to explain this case to their clients, executives and other business partners within their organizations.
The incident shows once again why companies need to make privacy a priority. Privacy professionals can learn from Facebook’s example, as well as use this case strategically as proof of the ROI of privacy. The Facebook and Cambridge Analytica incident puts privacy once again at the center of global controversy.
What’s clear from these past few weeks is that corporate privacy practices matter perhaps more now than ever before.
Making the business case for privacy
One of the most difficult parts of practicing privacy is arguably making the business case for privacy. Often, clients, executives, and business partners do not immediately grasp the necessity of spending resources on privacy. However, the Facebook and Cambridge Analytica revelations provide a great opportunity to advocate for more privacy focus in your organization.
Privacy compliance is not just a legal requirement or an ethical obligation. There are very real business costs to not taking privacy seriously. Just look at Facebook’s stock price, for example, or to the rising public criticism of the company. Privacy pros should take this opportunity to understand what lessons we can learn from Facebook and how we can use this example to make the business case for privacy when speaking to clients and corporate decision-makers.
As privacy professionals, we understand that it is impossible to ever perfectly protect privacy. There is no way to design a 100 percent secure system for collecting, accessing, storing, using, or transferring personal data. However, there are a few ways Facebook could have avoided the privacy harms or at least the negative public reaction from this scandal. These are steps any company could take to improve their own privacy practices. Privacy professionals can use these examples when advocating for more time, focus, and resources to protect privacy in their organizations.
Learning from mistakes
There are practical lessons privacy professionals can learn from Facebook in this case.
The company likely did not implement strong privacy-by-design principles when first creating a third-party app environment on its platform. There have been some issues in the past regarding third-party use of the Facebook API. One could argue that it was foreseeable that a third party would collect, use, and transfer Facebook user data in the way that Cambridge Analytica did. Companies should always make privacy part of the product development lifecycle. This can be done through internal trainings and education for employees involved in all aspects of the design process, as well as through the development of internal guides and policies on data collection, use, storage, and transfer.
Facebook could have placed stronger safeguards on third-party access to data instead of relying on its terms of service. They also could have implemented stricter standards for reviewing which apps were allowed on its platform.
There’s an important lesson to learn here for privacy professionals that’s larger than just third-party app review. In general, whenever companies allow third parties to access data, privacy professionals should take the time to do their due diligence in reviewing the access points and data flows that would result. It’s also important to consider the consequences of data use when negotiating contracts or service terms with third parties, including software vendors. Privacy professionals and attorneys negotiating data agreements should take into account legal obligations and guidelines, including those found under the EU General Data Protection Regulation, the ISO 2700-1 and ISO 2700-2 standards, and U.S. Federal Trade Commission guidance.
Facebook did not act to suspend or otherwise impose consequences on Cambridge Analytica until journalists had discovered the situation. Mistakes happen, even for privacy professionals. However, when companies discover flaws in data protection or privacy, they should take quick, responsive action to stop the unwanted flow of data or unwanted use of data. Not only is this beneficial for consumers, it also helps lessen the potential for negative public reaction should the story get out to the public. For any data-related issue that becomes a matter of public concern, privacy pros should be involved in the crisis management process, including providing guidance on communications. For example, Facebook was criticized early on when multiple executives emphasized that no “breach” had occurred. Perhaps more involvement on the part of privacy-focused teams would have helped shape the message in a more helpful manner.
Privacy pros should take heed to learn from Facebook’s example, so as to prevent the same kind of negative consequences from happening to their own clients and organizations and take advantage of this opportunity to use these unfortunate circumstances as an example of why business needs to invest in privacy.