Two approaches
Generally we can talk about two views on privacy - either the legal or soft policy view where rights are assumed maintained because some regulation, policy or agreement say so - or the "By Design" approach where principles are unconditionally forced or designed into technical design.
The legal or soft policy way
Often in the privacy discussion, we meet the argument that companies can build trust if they “respect” consumer privacy or the assumption that the discussion is about accepting some short-term loss (in not getting or using some personal data as an “asset”) in exchange of better “brand”-likeness attracting more business or have fewer security breeches.
Variants of this argument is in the area of “legal compliance”, i.e. deletion, non-collection, non-sharing, “settings” or more complex attempts for “compliance” in the form of sticky-policies trying to improve agreements negotiation using mechanisms such as P3P or to embed internal restrictions in “Digital Rights Management”-like rules.
A simple example of this “compliance” thinking is when surveillance feed from networked cameras are post-collection obscured in some way to reduce damage from means such as automatic face recognition and constant networked surveillance. A mechanism that in EU would violate the ePrivacy Directive (not enforced, but citizens are in themselves “devices” requiring prior consent), but represent an attempt to circumvent Data Protection Regulation post-collection through claims of “proportionality” or even exemptions due to non-substantiated claims of “national security” not considering alternative means.
In these compliance models, Data control is NOT with the citizens as they best case have some influence and have to trust some internal security mechanisms despite data flowing in external systems and through insecure infrastructure, These include cloud and internet-of-things where rules enforcement are close to theoretically impossible.
The market or security way - "by Design"
In contrast, Privacy By Design is the market/security approach Empowering the demand to enforce choice on value chains to drive progress and competition.
When technology is designed so citizens never loose control over the ability to link data outside context, the supply side is forced to adapt to customer needs and e.g. the customer retain the power to say STOP – simply by dis-continuing the process/relation and taking the business elsewhere.
We often hear claims of inconvenience or loss of value from real or legal restrictions for misuse of data out of context, but these are comparing apples and bananas as they fail to incorporate how citizens themselves reuse their data as part of market processes. There is no reason to assume that citizens are not as effective in applying the data management themselves – on the contrary, when considering issues such as interoperability, actuality and expression of needs, citizen self-management of data can be far superior to any “Citizen-centric” system control of data.
Companies and bureaucracies don´t like that unless they understand the necessity or their interest – and honestly no company dislike they have “market power” and few bureaucrats don´t assume society is better of with them in control. The rhetorical games to claim exemptions or “proportionality” are creative and widely abused to circumvent rights and security – healthcare research, tax and anti-crime are some obvious examples.
However, companies do understand that e.g. Google, Facebook, Amazon and (mainly US-based) payment/telco providers are selling their customers to competitors based on targeting information leaking in transaction (e.g. Google Analytics/Facebook Like and payments as probably the main problems today). The consequence is customer defection or churn which is the biggest drain on their profit as acquiring customer is costly and profits rely heavily on customer loyalty (increased profit over time and amortization of customer acquisition on many transactions).
When applying Privacy by Design, companies can significantly protect their customer relations from commercial 3rd party attacks as they stop providing targeting information. Customers may still chose other providers if your product/service offerings are not competitive, but at least the company stop the main drain on profits. In short Privacy By Design the market way is by far the best investment, any company can make – provided it is within their sphere of control to do so.
Just to exemplify in the Camera example above. In a Privacy or rather Security by Design approach, you would issue identity devices to Citizens making it possible to e.g. document non-wanted status, local authorization and even specific accountability without ever making the citizens identifiable in the transaction, i.e. no PII is created.
A local alarm can then be triggered either by law enforcement due to some specific incident/threat or a refusal by the citizen in question to provide the needed digital proofs. When the alarm go, a SPECIFIC and LOCAL change of priority and rights is established digitally, justifying that the PHYSICAL visibly curtains blocking cameras from collecting images can move away and evidence collection as well as incident management can commence.
Any such removal of physical blinds would be subjected to accountability whether personal or system providers on the trigger causing this under scrutiny by a judge.
Conclusion - By Design works where Soft policies fails
On a society level, blocking the abuse of personal data is by far the most urgent problems for getting markets to work again.
The winner-takes-all structure in commercial infrastructure is collapsing fundamental market processes based on prize/offering towards driving control to local or global monopolists. These profit from steering markets and filtering offers/messages or applying more powerful mechanisms to restrict behavior such as Smart-phone device lock-in where some players charge 30% transaction tax or more on all transactions through their “ecosystem”.
In my view, mere compliance are in the area of legal dreaming – like believing that alcoholic organizations can resist a data-drink on the table in front of them when it feels good short-term to abuse data even though it “may” hurt long-term. Never going to happen.
From a security and market power perspective, Privacy by Design are far superior to soft policy compliance as the consumer power is unconditional, enforced by design and trustworthy without any loss of legitimate value. Demand choice are enforced on market furthering best value for money and stopping the bad ones including from abusing data to prevent or control market processes.
I suggest that Privacy or rather Security by Design is the critical enabler of sustainable growth in our age. Something that mere soft policy compliance cannot provide.