Your company has already made a decision about privacy. It just doesn't know it

Privacy in a company is a strategic decision that shapes its relationship with customers and the soundness of its architecture. In this article we look at:

Why privacy matters, for people and for business.
Why regulation is a symptom.
A working definition of privacy and personal data protection.
The challenge of designing privacy into an organization.

Why care about privacy?

For citizens

Privacy has always mattered to us. The difference is that in the digital space the effects of losing it take far longer to show up than in the physical (analog) space, where we can actually feel it: when someone watches us for a long time, we sense that we are being observed, and our behavior changes.

Why does it matter? Because the lack of it gives others power over us, as Carissa Véliz would put it. Maybe your partner (who loves you) wants to know your birthday, your religion, your favorite music, your medical diagnoses, the phone numbers of your friends and family, so they can plan a surprise that makes you feel special that day.

But believe me: strangers (who certainly do not love you) knowing your date of birth, your religion and your medical diagnoses only gives them power over you. In extreme cases, the lack of privacy kills. It happened in World War II: the Nazis went through public records to find Jews. In France, they found and killed only 25% of the Jewish population (ref: the book “IBM and the Holocaust” by Edward Black). In the Netherlands, where those records existed, they found and murdered around 75% of the Jewish population. The difference came down to a Frenchman, Rene Carmille, who pulled off a “hack” during the national census the Nazis ordered. What he did was reprogram the Hollerith machines so they would not punch column 10+1, where citizens stated their religion. With that, he saved thousands of lives. Quite the hero, right?

Without privacy, there is no guarantee of equality, justice, freedom or democracy. You cannot guarantee freedom of thought when everything we read or watch is under surveillance, and you cannot guarantee confidentiality between lawyers and clients, or doctors and patients, when everything we say becomes a data point that is collected, analyzed and sold.

Privacy matters more than ever

For business

Businesses run on predictability and thrive on trust. When predictability breaks and trust erodes, the viability of the business usually suffers. If your customers feel their data and their identity are not safe in your hands, they will take their business elsewhere. That is why everyone, and engineers above all, should care about privacy.

Then there is reputation and legal compliance. The new law gives the regulator tools to examine privacy practices like never before. Privacy is no longer an optional act of goodwill: public awareness will keep growing, and companies face increasing scrutiny over how they handle and protect their customers' data. Mistakes and bad decisions are more likely than ever to come to light.

You should see privacy as an investment that protects your customers and positions your business as trustworthy.

Regulation

Governments pass privacy laws. Once in force, those laws become available to regulators and auditors. Regulators can investigate companies (in some cases even for practices that predate the law). At the same time, companies can be audited to prove compliance, which may be a requirement for signing contracts or entering certain markets. That means several laws can trigger audits, investigations and settlements at the same time.

Image: governments, laws and regulators. Source: our own work

It is tempting to think the problem starts with regulation, and that regulation piles on unnecessary complexity and slows innovation down.

Image: laws, authority, treaties and age of the laws in Brazil, Chile and Spain. Source: https://atlas.privacyengineering.cl/

Regulation shows up after years of incidents: leaks, unauthorized access, re-identification of users, abusive use of personal data. When those events keep repeating, public pressure builds, the media amplifies it, and governments respond. From an engineering standpoint, focusing only on complying with the law means arriving late to the problem. It optimizes for the symptom, not the cause. That is why, whatever the size of the company, it is important to work through your privacy gaps early, so you reach enough maturity to adopt emerging laws easily.

What do we mean by privacy and personal data protection?

I think many young people cannot even imagine what it is like to live with privacy

theconversation.com

The constitution gives us clues about these concepts, and mentions them separately in article 19, No. 4; “Right to respect for and protection of private life and the honor of the person and their family, and also the protection of their personal data”.

Let's try a working definition; “privacy” comes from the verb “to deprive”, so it is whatever is kept from other people's sight or knowledge. Which physical parts did we first try to keep out of other people's sight? They appear in the paradise myth of Adam and Eve: the “intimate” parts, covered with a fig leaf. That was probably the first expression, or the first symbol, of privacy (as an idea; the Agencia de Protección de Datos Personales could use it in its logo)

What is the evolution of our human species? Nothing more than the story of conquering spaces of privacy. At first we were hominids like every other animal, doing everything in full view of the rest. Then we started taking shelter, first in caves, later in houses, to keep certain things out of other people's sight and knowledge, and that is exactly what makes up our private life.

Now let's look at the different forms personal data protection takes. According to The Privacy Engineer's Manifesto, “data privacy can be defined as the authorized, fair and legitimate processing of personal information”.

Privacy is closely tied to security. Where privacy goes one step beyond security is that security focuses mainly on protecting against malicious outsiders, while privacy demands that processes and systems also protect data from internal misuse.

In that sense, privacy begins once you have reached an optimal level of security. As I read somewhere on LinkedIn: “security is a necessary condition for privacy, but not a sufficient one”.

According to the International Association of Privacy Professionals (IAPP), “information privacy is the right to have some control over how your personal information is collected and used”.

I like that one, because it gives the user a sense of control even when their data is used while they are not there

Finally, my favorite definition, from the book Data Privacy: “data privacy refers to the tools and processes needed to protect user data, preventing it from being processed or accessed in ways the user does not expect.”

That definition matters especially because it puts responsibility for privacy where, to my mind, it belongs: on the companies that collect user data and profit from it.

Where privacy ends and data protection begins

The two concepts live in the same clause. Article 19 No. 4 used to protect private life and honor; the phrase about personal data was added in 2018, with Law 21.096 (it took a constitutional reform to put it there).

Privacy protects a space; personal data protection governs a relationship. The answer to an intrusion into your private life is "don't look". We cannot answer the processing of our data the same way, because we hand it over and because we want it used: we want the bank to identify us and the clinic to have our file. What we can demand is conditions, and Law 21.719 sets them out on two levels: the principles that bind whoever processes the data, in article 3, and the rights the data subject can exercise, in articles 4 through 9.

Thinking about privacy as a system

So we need to start seeing privacy as an emergent property of the system, one that rests on three core capabilities

First, the ability to know. Know where the data is, how it flows, who touches it. Then, the ability to reduce. Shrink the data surface: every piece of data you don't store can't be exposed or replicated, and that's one less problem in the future. Finally, the ability to protect. Control access, audit actions, guarantee traceability.

Image: building privacy into the organization.

A well-designed system, one that understands its data, minimizes its exposure and controls access to it, naturally tends to behave better on privacy. As I mentioned earlier, these three layers (know, reduce and protect) are properties that have to run through the whole system.

To my mind, this is the foundation of Privacy Engineering, which I love madly

Privacy tooling

The tooling discussion always comes up. Build or buy? It is a question leaders have to weigh together with their engineers. In the end, the engineers are the ones who will have to implement whatever is chosen, so it matters that they have an informed view.

Based on what we covered above, I recommend thinking about privacy tools in these three categories:

Know: know where personal data is discovered and located.

Reduce: reduce the exposure surface through obfuscation and deletion.

Protect: protect by applying access controls.

Source: adapted from an image in the book Data Privacy

When teams buy or build tools, they need to understand what problem they are solving and how the tool or approach under evaluation contributes to that solution. Then comes the hard call: do they build privacy tools in-house or buy ready-made third-party solutions? Those can range from end-to-end privacy platforms to more narrowly scoped tools.

Engineers, tech leads and architects tend to lean toward “build” as a starting point, for several reasons:

In-house solutions benefit from contextual and technical consistency with the company's existing stack, and they can be easier to integrate into a distributed architecture.
Engineers who feel the gaps and inefficiencies in privacy tooling firsthand can build solutions that line up better with immediate needs.
There is often resistance from “finance” to buying third-party tools, especially because of licensing costs.

I agree with these arguments, but in-house solutions have their limits too:

Engineers usually work in silos and rarely look at the full stack or end-to-end data traceability. They tend to focus on what is relevant to their own products, favoring depth over breadth. That can blind them to downstream privacy and security implications. So relying on those same engineers to build privacy tools with complete coverage can be risky. On top of that, these solutions are often shaped by recency bias: they solve recent, urgent problems instead of anticipating future ones. In other words, they optimize for “stopping the bleeding” rather than “building muscle”.
Engineers change teams or jobs often, which can create maintainability problems. Privacy tools usually require deep integrations with data warehouses, pipelines and APIs, plus high scalability and availability. Without stable ownership, both the ability to build these tools and the institutional memory around them suffer.
Modern B2C services usually favor availability over consistency (backend errors, for instance, can go unnoticed by the user), but privacy tools have to support audits and reporting, where accuracy and completeness are what count. In those cases it can be better to use proven third-party tools than to risk in-house solutions that might fail during a critical incident.

There is no single answer to the “build vs. buy” dilemma. Still, when you explore options to automate and operationalize privacy, these considerations work as a guide. Unless you have a large team dedicated to building internal tooling, you will probably need to evaluate third-party solutions.

The real challenge is organizational

Perhaps the biggest obstacle to implementing privacy effectively is organizational. Privacy cuts across systems, teams and disciplines. Organizations, though, are structured in silos. Each team optimizes locally, while privacy needs a global view.

That creates a disconnect: nobody has the full picture, but everybody makes decisions that have an impact. The result is a lot of small misalignments that add up into a structural problem.

So when should you start?

You can do it at the beginning, when the cost is low and the decisions are still malleable.

You can do it after the first incident, when the pressure is already on.

Or you can do it in the middle of a crisis, when every decision is reactive.

Most organizations choose the third option ... .And that one is, consistently, the most expensive.

Closing

Today we have more tools, more regulation and more examples than ever. And still, privacy problems persist. That is because we keep treating privacy as something external to the system, when it is really a direct consequence of how we design it.

Privacy is not added at the end.

It cannot be bought outright.

It is designed. And like every good architecture decision, you either pay for it once or you pay for it forever.

---