We need to talk about how we talk about privacy | by James Shelly | Ethyca

We need to talk about how we talk about privacy

James Shelly
6 min read · Jun 1, 2022

I’ve been pretty plugged into privacy industry discourse for a while, and I’m increasingly convinced we have a meaningful communications problem that negatively impacts our core mission: strengthening the (largely digital) privacy of people everywhere.

I believe there are currents below the surface of our community that make it really hard to talk honestly about the state of privacy today. To tell the truth, basically.

My perception is that the issue breaks down along a few vectors, but taken together they make it nearly impossible for the privacy industry to “say what it does and do what it says,” which is the communications bedrock of a healthy, trusting relationship between two parties.

Truth. Trust. Privacy. These qualities are all very intimately connected, so a truth deficit in the privacy industry is…bad!

I want to share my point of view on how addressing these problems:

… can enhance the utility of our privacy conversations, and ultimately better propel us towards achieving our shared mission of strengthening privacy for humans everywhere.

The priors problem

First, our priors are off: we are compelled to converse as though privacy is more “solved” than it actually is.

In other words, most public discussions about privacy start with an implicit base assumption that organizations are, in some commercially sustainable fashion, already able to follow the letter and spirit of privacy’s flagship law, GDPR.

I’m sorry, but this is just not true (yet).

In intimate conversation, most everyone will acknowledge to you that this is not true. Privacy by Design, as enshrined in GDPR Article 25, represents a gargantuan technical challenge that will take far more than the six years the law has existed to truly solve for most large enterprises. Internally, Facebook’s privacy engineers compared the task to putting ink spilled into water “back in the bottle.”

I would love if we could admit this in public because it colors everything, especially the public’s perception of the investment, effort, and progress companies are making in regard to continually improving their oversight of data processing.

Admitting this fact does not absolve organizations from blame for committing privacy violations, or discount the possibility of truly malicious intent when it comes to wrongdoing in data collection or processing.

It also doesn’t absolve companies from being way too late to understand that a team of lawyers can as easily enforce fine-grained governance on the modern data stack as I can train my cat to do the Macarena.

But it does acknowledge the present truth. And the truth will set us free to speak more productively about the work being done in privacy. Yes, there are legally compelling reasons that the DPO at a large organization can’t talk openly about the sheer volume of legacy privacy debt they’re working through, but those pressures do not equally apply to vendors and commentators in our industry.

We have the power to move the conversation to a more accurate starting point. I think we should do so.

The tone problem

The priors problem begets a tone problem. When one adopts a baseline position that things are more “solved” than they actually are, one is perfectly positioned to shake their fists at the sky when the simple truth is laid bare.

This means that in our field incentives skew heavily towards focusing on the bad stuff.

You don’t need to be around the privacy community for long to see it’s a gloomy place (good-naturedly gloomy, but gloomy nonetheless). It makes money by facilitating compliance, and we have a sizable and important contingent of folks that earn their corn by very capably identifying and discussing non-compliance. It also makes money when businesses are scared that they’ll get fined. So there’s an incentive to squawk loudly when large judgments are rendered, penalties assessed, etc. (we at Ethyca are certainly not immune to this!). The tendency to scold and scaremonger in the privacy industry is a product of strong commercial incentives. And if the benchmark is a gold-standard GDPR privacy operation — as it should be — there really is a lot wrong to talk about.

But we also don’t have a strong counterweight to this negative comms incentive — i.e., we don’t have a good way to discuss privacy wins.

The best privacy work is often tedious, unglamorous stuff. Spelunking around legacy data infrastructure to categorize PII, stitching together data lineage over weeks and months, working really hard to align your data processing activities with those stated in your privacy policy; this is not stuff that makes it into TechCrunch. And since all those things are expected to already be nailed down under the auspices of GDPR, no one can highlight the work even if they want to — they’re admitting to a previous state of non-compliance!

Taken in sum, these realities mean we are always talking about the bad stuff. If you talk like that long enough, there are a host of trust-damaging impacts.

Readers start defaulting to assumptions of malice when considering businesses that may be working hard to try to protect their data. They may start thinking that no one is genuinely committed to solving thorny privacy problems, or worse, that it’s not actually possible to fix the problems.

Are the median organization’s data privacy practices deserving of user trust yet? Probably not! But our discourse is digging an awfully deep trust hole that we’ll have to work doubly hard to get out of. Once you start to assume that everyone is just intentionally bad at privacy, it’s difficult to wayfind back to a relationship of mutual respect.

So I think we need to find avenues to better highlight the hard work teams are doing every day to make technology systems more respectful of end-users, if only to allow for the possibility that truly respectful systems could — will — be a genuine widespread standard in the not-so-distant future.

The trustworthy narrator problem

So those are two structural components of our industry that make it hard to discuss privacy truthfully:

The result is kayfabe: a discourse that maintains an impression of privacy reality everyone knows to be inaccurate.

Lastly, consider that there are a significant number of actors in our space whose continued commercial viability depends on ensuring the kayfabe isn’t broken.

There are hundreds of millions of dollars being spent each year on compliance with GDPR, CCPA, and other privacy laws. But as per above, it’s very, very uncommon for that money to be purchasing the service that is promised, which is: truly solving the privacy question for large organizations.

That’s because the tools that can conclusively solve these challenges — of Privacy by Design, Privacy by Default, and more — are only now starting to reach maturity six years after GDPR was enacted (and business privacy cultures are unfortunately evolving at similarly delayed pace).

This creates an interesting and troublesome dynamic in our industry; the compliance kayfabe has birthed an industry of solutions that are not solutions at all.

To maintain their position, those actors would have us believe that this is really as good as it gets, this is the way it will always be, and that we will need to continue to nudge-nudge and wink-wink and hope to goodness no regulator asks straight to our face if we can swear our Article 30 RoPA is up-to-the-minute accurate and exhaustive, because how could that even be possible when our company has 37 PosgreSQL databases and 200 SaaS subscriptions all piping data into a warehouse that is used by 20 different business units for Lord knows what?

Well, of course it is possible and soon it will be true table stakes for any company, as it should be.

But for now we exist in an odd limbo, where it’s not really possible for the privacy industry to speak openly and honestly about the state of things, to the benefit of industry gatekeepers and the detriment of general trust.

I believe our inability to tell the truth hurts our industry in its mission of mission of strengthening privacy protections for internet citizens everywhere.

But I also have reason for hope; I believe that innovation in our space is rapidly bringing the vision of Privacy by Design closer to widespread attainability, such that open conversations about “the state of things” will no longer be so fraught.

Soon we will be able to break the privacy kayfabe for good.