By embedding privacy controls into legacy systems, organizations can minimize the risk of data loss and achieve greater levels of protection, Ann Cavoukian, information and privacy commissioner of Ontario, said Tuesday at SC Congress Canada in Toronto.
Cavoukian, who developed the widely lauded and copied "Privacy by Design" approach for embedding privacy into the design of business practices and network infrastructures, has released a new paper outlining how organizations can deal with the challenges of building privacy controls into legacy systems.
Most organizations today already have mature systems, which were developed over time without privacy in mind. Replacing such systems, which often still meet business needs, is often not an option, she said.
Instead, organizations should transform their existing systems using the Privacy by Design principles, which include anticipating privacy blunders before they happen and making privacy the default setting for all IT systems.
To begin the transition, organizations must first rethink their existing risk mitigation processes and consider alternative approaches that better protect privacy, according to the paper, called "Privacy by ReDesign: Building a better legacy," which was released last month.
To redesign systems using this approach, organizations will likely need to limit the amount of personal information they maintain and reduce the amount of time it is stored, Cavoukian said. The effort may include eliminating unnecessary data fields stored in databases, coding information so it is not stored in plain text format and restricting the use of data.
Systems should ultimately be engineered to protect privacy and achieve key business requirements, she added.
But, such a change may require a change in thinking, Cavoukian admitted. Privacy should no longer be pitted against security or be viewed as a tradeoff. Building both security and privacy into systems may require more effort than focusing on security alone – but will ultimately yield greater levels of protection and reduce the risk of data loss, she said. After all, building privacy in after the fact will present organizations with a huge cost burden.
“It's not one or the other,” Cavoukian said. “Of course you can have both [privacy and security].”