Let's Talk Privacy: Exploring how privacy and data governance policies translate into practice

 Stephanie Nguyen

Let’s Talk Privacy explores how the implementation of privacy and data governance policies might impact a variety of fields.

Project Let’s Talk Privacy explores how the implementation of privacy and data governance policies might impact a variety of fields. Our project title reflects our work in engaging a more diverse set of voices into conversations around privacy and data governance. How do these policies translate in practice? How they might affect us? To find out, we interviewed 41 people – including lawyers, designers, engineers, advocates, policymakers, and stewards of sensitive data (social workers, pediatricians) – about three federal draft data and privacy related bills. Our objectives were to 1) explore intersections of privacy policy and design through visual prototypes; 2) identify the challenges of translating policy to platform changes based on the specific background and industry skill set of the interviewees; and 3) understand broader perspectives of privacy and control in technology.

In the short time we’ve been working on this project, privacy and data protection conversations have evolved. While our work began several months ago, the insights and questions that our research surfaces are timely and relevant to evolving technologies, even during a pandemic. Questions surrounding surveillance and intrusive tracking overlap with questions about how to strengthen privacy protections using both technical and policy implementations. The emergent conversations around government surveillance and privacy during this pandemic are mentioned here as an important reminder of why privacy is such an important and fraught space.

Our research reflects only a small portion of the diverse perspectives we can bring to data governance and policy making. In particular, our research focuses only on policies in the United States. In the future, we hope to spur more conversations, reveal new insights, and prompt positive action.

Some things we recommend

Develop shared privacy language across industries.

This could assist in identifying overlapping processes, concerns, interests, and harms, as well as enable better collaborations between individuals from different sectors/professions.

Include insights from people from marginalized communities and data stewards.

It’s important and valuable to talk to those who know or have a good understanding of how they have been impacted by these systems & policies.

Implement human-centered practices in the policy design process.

Practices that could aid the policy design process include broadening engagement with industry practitioners, visualizing policies to prototypes when possible, exploring how to test policy and prototyping processes on a larger scale, and continuously integrating feedback.