Primarily, we at Securys think that privacy is about trust. It’s no accident that we interchangeably use “confidence” to mean both trust and secrecy, we must trust in those in whom we confide.
Good privacy lies in winning and keeping that trust. The eight principles of the GDPR are merely signposts to some of the behaviours that achieve that goal; treating privacy regulation as an exercise in compliance box-ticking, while it might mechanically produce some of the outcomes intended by the legislation, will not bring with it the deeper bond that inspires confidence.
Trust is an interesting concept. It is bilateral but can be initiated unilaterally – if I demonstrate that I trust you, you will be more inclined to trust me. It is emotional but can be both supported and destroyed by cold evidence. It is fragile – how often have we seen reputations undone by a single poor decision? – but also resilient, because often what is trusted is the intention more than the act, so that a heartfelt apology can often compensate even for an egregious mistake. Trust is the rock on which brands are built and, like brand-building, trust is earned through consistent and repeated application of effort.
Data subjects, so people, are not stupid. They can tell the difference between an organisation that’s doing the minimum to avoid regulatory sanction and one that genuinely cares about them.
Employees will seek out, work harder for, and stay for longer with an employer who demonstrates not only that it takes good care of the data it necessarily collects about them but also that it has faith in them. Monitoring an employee’s every working moment may seem like a route to enhanced productivity, but it is far from a demonstration of trust.