Over the course of two weeks for the iconic SXSW conference, Austin, TX, is filled with a wide array of smart and engaging people, many of whom are building some of the latest technologies, developing savvy new start-ups and working hard to get those products and services out to market. New to many of those young start-ups and fledgling companies is the idea that they need to implement privacy and data security protections for their users.

With that as a backdrop, some of the world’s top chief privacy officers (CPOs), who lead privacy teams for some of the technology sector’s most established companies, got together on Saturday to discuss how they are handling some of today’s most pressing and complex privacy issues.

"What Keeps the Internet’s Leading CPOs Up At Night" panel at SXSW 2015.

“We think of people first,” said Facebook CPO Erin Egan. “We do that so we can build trust.”

“Trust is a key part of this,” agreed Microsoft CPO Brendon Lynch, CIPP/US. He explained that he and his team constantly ask key questions during the product development life cycle. Across the company, he added, the team has embedded “privacy champions” who are generally perceived by other teams within Microsoft as partners. And with a “dotted line” to the corporate office, Microsoft has recognized that it’s important to get privacy right in the marketplace.

“As you try to manage down privacy risk,” said Google Senior Privacy Counsel Keith Enright, “all the legal and regulatory challenges can be difficult.” As a response, he explained, Google looks for feedback from its users and works with other experts within the company so that the privacy team can better understand the technologies and issues others teams are working with. “We partner our folks with experts in the mobile space or the wearable space, for example, so they understand the unique things within those spaces.” That way, privacy professionals within Google develop needed subject matter expertise.

Facebook’s Egan added that it’s important to make sure your users know what they are doing with their data when they post something and then, from there, build and provide them with tools to help control how they use their data. In addition to providing its users with an understanding of how they are using their data, Egan said it’s also important to help educate policy-makers and regulators on their products and services. “They’re the ones passing the laws,” she said, “and they’re the ones regulating us, so it’s important to help them understand how it works and the controls users have.”

And what about regulators’ perceptions about privacy? Do they tend to care more about it than consumers?

“Generally, laws and regulations set a floor and not a ceiling,” explained Microsoft’s Lynch. “Take individual perceptions of privacy as well. Some consumers care very deeply about privacy, while others don’t care about it much at all. For us, protecting privacy is beyond what the law requires. We try and anticipate what their expectations are, and quite often, we find, consumers are more demanding than the law.”

Google’s Enright disagreed. “I think users want their products to work. They want them to be efficient and they don’t want policies to disrupt that experience," Enright said. "In my experience, the regulations and laws often set up hurdles and obligations that are way outside of the contemplation of our users.”

Egan chimed in by noting, “Users want to understand how to use our services. Regulators, however, are trying to imagine scenarios and often set unrealistic expectations.”

IAPP President and CEO Trevor Hughes, CIPP, pointed out that companies can often comply with the law, but noted, “Just because it’s legal, it can still be stupid.” He asked, “How can you gain authority within your organization when the product and marketing teams want to do something stupid but purely legal? In this ‘creepy’ area, where do you get that authority?”

Enright said that is one of the great challenges in the early stages of an organization, when it's trying to get its product or service to market quickly. “It’s not difficult in my organization because we have been scrutinized so much," he said. "We have not always done the best and we’ve made mistakes, and we’ve felt the consequences of that. For us, user trust is absolutely essential, and Larry Page recognizes we can’t get this wrong.”

As an example, each of the panelists discussed how they dealt with major privacy blows in the past. Specifically, Lynch talked about the privacy designs that were embedded in the Xbox Kinect, an interactive gaming console that received scrutiny for its facial-recognition features. He said, however, the company began with Privacy by Design. “We didn’t need to store images on our servers,” he said. Plus, the facial images were only points on a given face, so even if the data had been accessed by a bad actor, it would make no sense. The biometric data was also stored locally and deleted after the given session ended.

But, Lynch asked, “How do you teach consumers how the privacy protections are working?”

There are multiple ways to achieve that, he explained: Provide a user interface to explain the uses to consumers. Plus, build a FAQ page that explains user controls and drives people there. Finally, he added, engage external stakeholders and talk with consumer groups and regulators to help mitigate misunderstandings.

Looking forward, Enright said it will be important for companies to give users more controls, noting, “They can be empowered with the data about them.”

Facebook’s Egan agreed. “I hope," she said, "to see more control at the center of people and for them to have more control of their information.”

Lynch, however, offered a different perspective. “There’s so much information out there," he said, "much of it with predictive capabilities, and with that, there needs to be more discussions about the ethical uses of personal data. We need more systematic approaches to privacy rather than placing the onus on the individual.”

Really, whether society goes to a more use-based or collection-based model, it will be many of the young entrepreneurs here at SXSW who will play a large role in determining these outcomes. Established companies like Google, Facebook and Microsoft have learned their lessons the hard way. The question remains, then, whether these younger companies will learn these lessons the hard way, too.