This workshop reviewed the lessons from workshops #1-3 and examine how existing regulatory models, along with other factors, shape organizations’ understanding of privacy problems, approaches, and solutions. Building on workshop-generated insights on the strengths and limitations of current approaches—in terms of concepts, incentives, actors—the workshop considered how well regulatory models respond to privacy-by-design challenges, and identify open research questions. A goal of the overall project was to broaden the lens through which privacy-by-design is viewed by the research community—positioning technical design along side theoretical/conceptual, organizational, and regulatory design questions. Thus, gaining some understanding of the forces that drive the choice of methods, tools, and approaches is a core goal of engagement with industrial innovators. Organizational practices including the development of internal privacy expertise of various sorts and at various levels of the organization, privacy education and training, and mechanisms of accountability may—and from the regulators’ perspective should—comprise part of the privacy-by-design ecosystem with an institution. Legal choices—both substantive and institutional—appear to influence firms’ investments in these features. Building on insights from earlier workshops we identified open research questions about the relationship between regulatory form and other external and internal features of the privacy field, and the expression of privacy in firm practice.

Privacy by Design

This workshop was one of four aimed at identifying a shared research vision to support the practice of privacy-by-design. They convened both practitioners with direct experience of the challenges in implementing privacy-by-design from a range of fields—software developers, privacy engineers, usability and interaction designers, chief privacy officers—and researchers from an equally broad range of disciplines.

The goals for the four workshops included:

• To take stock of the methods, tools, and approaches currently used to design for privacy.
• Broaden the lens through which privacy-by-design is viewed by the research community—positioning technical design along side theoretical/conceptual, organizational, and regulatory design questions.
• Begin the process of building an interdisciplinary community of researchers to develop broader theoretical foundations, systematic approaches, as well as organizational and regulatory models for supporting the practice of privacy-by-design.

Previous Privacy by Design Workshops
Workshop 1- State of Research and Practice
Workshop 2- Privacy Enabling Design
Workshop 3- Engineering Privacy