The article “ 7 Laws of Identity: The Case for Privacy-Embedded Laws of Identity in the Digital Age ” by Ann Cavoukian, Ph.D., offers a profound and insightful look at the importance of privacy and identity in our ever-evolving digital age.

The document updates privacy-focused Identity Laws, particularly those related to Fair Information Practices.

It can also be seen that there is an intrinsic relationship with Privacy by Design , a framework developed by Cavoukian while she was the Information and Privacy Commissioner for the Province of Ontario, which was recently highlighted with the creation of the ISO 31700 standard, adopted from February 2023.

The objective of this article is to briefly demonstrate the applicability of controls outlined in the ISO standard for implementing the 7 Laws of Identity in an organization's privacy governance program.

With this focus, we have listed three topics: 1. What are the 7 Laws of Identity? 2. The new ISO 31700 and Privacy by Design. 3. ISO 31700 controls in application.

What are the 7 Laws of Identity?

The digital age has brought with it countless technological innovations that have transformed the way we live, work, and connect. However, this technological advancement also raises significant questions about privacy and the protection of personal data.

The emergence of digital identity technologies is undoubtedly a universal advancement and facilitator for identifying people. However, we must be cautious so that an interoperable identity system is not distorted and becomes a surveillance structure (CAVOUKIAN).

Thus, the 7 Laws of Identity were formulated in an open blog by experts under the leadership of Kim Cameron, then head of identity architecture at Microsoft, in 2005. 

Professor Ann Cavoukian has reformulated the Laws of Identity, also known as the Technologically Necessary Principles in Identity Management, which can serve as the basis for a more secure and privacy-centric digital identity system. These laws are:

1. LAW 1: Personal Control and Consent

1. Technical identification systems should only reveal information that identifies a user with the user's consent. Personal control is fundamental to privacy, as is freedom of choice. Consent is fundamental to both.

2. LAW 2: Minimum disclosure for limited use: Data minimization

1. The identity system should disclose as little personally identifiable information as possible, as this is the most stable and long-term solution. Furthermore, it offers the greatest protection for privacy.

3. LAW 3: Justifiable Parties: Access only to those who need to know

1. Identity systems should be designed so that the disclosure of identifiable information is limited to the parties who need it and whose access is justifiable. This is consistent with imposing limitations on the disclosure of personal information and allowing access only on a need-to-know basis.

4. LAW 4: Targeted Identity: Protection and Accountability

1. A universal identification system should be flexible and respect people's privacy. The identifiers we use online can be secret, used only between us and the person we are talking to, or public, provided by trusted entities to confirm our identity. This helps keep our personal information secure and under control. 

5. LAW 5: Pluralism of operators and technologies: minimizing surveillance

1. The interoperability of different identity technologies and their providers should be enabled by a universal identity system. This offers users more options and control over the means of identification in different contexts, minimizing unwanted tracking and profiling based on personal information obtained through surveillance across various websites.

6. LAW 6: The Human Face: Understanding is the key

1. Users should play a relevant role in any system, being integrated through clear communication. This will promote user control, but only if users truly understand. Therefore, simple language in all communications used to interact with individuals is fundamental for understanding and greater protection.

7. LAW 7: Consistent experience across diverse contexts: greater user empowerment and control.
   1. The universal identification system should be easy to use and consistent. It should allow users to control their information in different places. This means that people have the power to decide who can see their information. Having clear options and controls helps individuals make informed decisions about their personal information and have more control over it.

(Translated by: Matheus Bicca)

As can be seen, this framework seeks to empower the user of the identity system, that is, the identified person themselves. It provides guidelines that, if applied, should guarantee control over the data by the data owner.

The new ISO 31700 and the Privacy by Design

With a good understanding, it can be inferred that the 7 Laws of Identity are extremely correlated with Privacy by Design (PbD) , considering that its seven principles are:

1. Proactive, not reactive; preventive, not corrective.
2. Privacy by default.
3. Privacy built into the design.
4. Full functionality: positive sum, no zero sum.
5. End-to-end security – complete lifecycle protection.
6. Visibility and transparency.
7. Respect for user privacy – it's at the heart of everything.

The PbD (Privacy by Design) approach is fundamental and essential when creating and developing technology, business models, or physical infrastructure. According to this concept, privacy should be integrated into the product or service from the outset, avoiding the need for later adjustments or corrections that can be costly and ineffective.

In this regard, in February 2023, the new ISO 31700 standard was published, which aims to provide guidelines for organizations on how to practically implement PbD (Product by Design).

This author believes that, given the correlations between Privacy by Design and the 7 Laws of Identity, we can utilize some of the controls provided by the ISO standard for application in universal digital identity systems.

Examples of ISO 31700 Controls applied to Digital Identity

To better illustrate this, we will use practical examples where the application of ISO 31700, and consequently, Privacy by Design, can bring value to mitigating privacy risks in digital identification systems.

Example #1:

Regarding the misuse of data, or the ethical use of data by an employee of the company providing the digital ID.

Law of Identity: LAW 6: The Human Face: Understanding is the key.

Privacy by Design Principle: Visibility and transparency.
ISO 31700 control applicable: 5.2 Providing privacy information.

Here, the key point is to inform the user exactly how their data is being handled.

Example #2:

For your identity to be used and sent to other environments, the user's consent is required.

Identity Law: LAW 1: Personal Control and Consent

Privacy by Design Principle: Privacy as Default.
ISO 31700 control applicable: 4.2 Designing resources to enable consumers to ensure their privacy rights are upheld.

The idea is to give the user the power of control, in the best sense of informational self-determination.

Example #3:

The guarantee that identification data will only be processed between the interested and authorized parties in the process.

Identity Law: LAW 4: Targeted Identity: Protection and Accountability

Privacy by Design Principle: End-to-end security – complete lifecycle protection.
ISO 31700 control applicable: 6.6 Including privacy risks in cybersecurity resilience design.

It is clear that the application of technical information security measures is essential to guarantee user privacy and the effectiveness of other controls.

Without intending to exhaust the subject of correlation presented, considering everything discussed, it is evident that the frameworks presented in this article are strongly interconnected.

While Privacy by Design and , consequently, ISO 31700, have widespread application across organizations, the 7 Laws of Identity are dedicated to guiding providers of digital identification systems, and can utilize the other controls and principles presented for a better interpretation of the third framework.

A legal professional in the digital age must be aware of the nuances that characterize the modern world. Today, as we can see, mere knowledge of codified law is no longer sufficient; it is necessary to seek knowledge and solutions in a wide variety of fields.

The postgraduate program in digital law and data protection at IDP offers a wide range of subjects that address both legal and technological innovation, providing students with multi-sectoral knowledge.

Furthermore, the professors are nationally and internationally recognized professionals in their fields of expertise, bringing insights into the market and direct market trends.

Be sure to follow us on social media and share our articles from the IDP Blog. 

References

CAVOUKIAN, ANN. 7 Laws of Identity: The Case For Privacy-Embedded Laws of Identity in the Digital Age. Canada, 2006.
CAVOUKIAN, ANN. Privacy by Design: The 7 Foundational Principles. Canada, 2009.

ISO 31700. 2023.