Privacy Primer

Mastering the Data Privacy Basics

What is Data Privacy?

Data privacy today is about:

• Protecting consumers through laws and regulations. A growing list of policy initiatives — GDPR, CPRA, and many more — protect peoples’ data from exploitation and preserve the right to privacy online. Concerns range from mass commercial surveillance to algorithmic decisioning, to law enforcement data rights, to keeping our children safe online (and the list goes on).
• Building trust by conducting responsible business. Businesses have a huge opportunity to uphold the consumer contract and use privacy as a brand differentiator. Companies like Apple and Okta are doing this to grow their revenue bottom line already, turning compliance into an advantage.

Say “data privacy,” and dozens of definitions probably come to mind.

To you, it might mean securely storing passwords in an encrypted app, installing an ad blocker after clicking on “Decline Cookies” for the thousandth time, or withholding your contact information when retailers relentlessly ask for it at the checkout counter.

But for businesses and privacy leaders, it is about ensuring that privacy powers all business practices.

If this data privacy landscape sounds complex, that’s because it is.

In this guide, you’ll learn what data privacy is, the key laws your company is accountable to, why it’s important to you and your job, and how to overcome common challenges.

What is Data Privacy?

Data privacy, called “data protection” in Europe, is about protecting people’s right to privacy in an increasingly digitized world. Since the 1960s, privacy has been an internationally recognized human right. Article 12 of the Universal Declaration of Human Rights (UDHR) requires that no person be “subjected to arbitrary interference with his privacy, family, home or correspondence…” and that “everyone has the right to the protection of the law against such interference or attacks.”

Relational databases became exponentially cost-effective through the 1970s and 80s, making it easier than ever to store, search, and analyze electronic data at scale. In response to these advances, the UN Human Rights Committee called for laws that protect individuals’ privacy rights as well as their data. The 1970 U.S. Fair Credit Reporting Act (1970) and the 1973 Swiss Data Act were some of the first such laws.

As information technologies advanced, so did the opportunities and risks from an increasing volume, variety, and velocity of personal data. In response to these challenges, the European Union enacted the pan-European 1995 Data Protection Directive. Across the Atlantic, laws like the 1996 U.S. Health Insurance Portability and Accountability Act (HIPAA) and 1998 U.S. Children’s Online Privacy Protection Act (COPPA) continued America’s focus on specific data privacy issues.

Today, Europe is thought to have the world’s most comprehensive privacy regime thanks to its 2016 General Data Protection Regulation (GDPR). Among other benefits, the GDPR strengthened existing protections for Europeans and added more ways for them to control their data. The GDPR also inspired an ongoing series of global privacy reforms, including in the U.S. by way of the comprehensive 2018 California Consumer Privacy Act (CCPA).

As such, data privacy is also about the laws and obligations that inform how organizations should protect personal data and mitigate their interference with our rights to privacy.

What is “Personal Data”?

Personal data is defined differently under different laws, but overarchingly, it is data that relates to an individual. Every time you stream a show, buy a product online, register for a newsletter, pay your bills, download a free app, or apply for a credit card, you give up data about yourself. Even without your knowledge, information about who you are, what you do, and what you like is compiled and analyzed behind the scenes for a variety of uses.