The ‘privacy by design’ approach for mobile apps: why it’s not enough

This story was first published in The Conversation.

The consent model on which privacy laws are based doesn’t work. App users remain concerned about privacy, as a recent survey shows, but they still aren’t very good at protecting it. They may lack the technical know-how or the time to review privacy terms, or they may lack the willpower to resist the lure of trending apps and personalised in-app offers.

As a result privacy laws have become more detailed, imposing additional requirements about notice, data minimisation, and user rights. Penalties have become harsher. And the laws are often global in reach, such as the US Children’s Online Privacy Protection Rule and the EU’s General Data Protection Regulation. For instance, a South African developer of an app downloaded by children in the US and the EU must comply with both and with South Africa’s Protection of Personal Information Act. This complexity can create a significant compliance burden.

But the real problem, according to a report by the EU Agency for Cybersecurity, is that lawyers and app developers don’t speak the same language. An app developer may have no idea how to translate abstract legal principles into concrete engineering steps.

As a result regulators have looked to the concept of “privacy by design” as a way to bridge this divide. The concept was coined in the late 1990s by Ann Cavoukian when she was the Information and Privacy Commissioner for Ontario, Canada. Privacy by design goes beyond privacy policies and in-app permission settings. It requires developers to think about privacy from the first moment of the design process.

Cavoukian set out seven foundational principles for a privacy by design approach. But it is the second principle, “privacy as a default setting”, that really sets the bar for a privacy-friendly app.

Build in the maximum degree of privacy into the default settings for any system or business practice. Doing so will keep a user’s privacy intact, even if they choose to do nothing.

This places the responsibility on the app developer to think about the user’s privacy upfront, and design the app in such a way that privacy is protected automatically, while still offering a fully functional app experience.

But my research showed that design decisions made by app developers are constrained by existing technologies and platform rules designed by others. These include the device hardware and operating system, the software development kit, ad libraries and app store review policies.

The answer is privacy by (re)design, where all role players in the ecosystem take privacy seriously and redesign existing platforms and technologies. But enforcing that approach will require tighter legal regulation of third party data sharing.

Image: madartzgraphics / Pixabay

• Check contract terms and third party code carefully;


• Monitor developer platforms for security and privacy updates;


• Only work with organisations that offer adequate privacy guarantees;


• Notify your users about data transfers to third parties and provide easy to use privacy controls.


• Keep logs so that you can respond promptly if an app user requests details of the personal data you hold and the recipients (or categories of recipients) of that data.