Research pillar · Zero Security Theatre
The dangers of data privacy theatre
Most privacy programs are documentary. Notices, consent language, contractual clauses, and a data inventory maintained by interview. This pillar studies privacy as an engineered property of running systems, where the claim in the notice can be checked against the behaviour of the data.
The question
Can we prove that data is handled the way our privacy documents claim?
Active · since 2026 · Zero Security Theatre
The gap between the notice and the system
observation
A privacy notice is a claim about collection, purpose, retention, sharing, and deletion. In most organisations nobody has tested that claim against the systems. Fields are added by product teams, copies accumulate in warehouses and analytics tools, vendors receive exports, and backups hold data long after the stated retention period.
The document is usually accurate about intent and frequently wrong about practice. That gap is not dishonesty. It is the ordinary result of documents being written once and systems changing weekly.
Privacy properties that can be tested
recommendation
Some privacy promises can become scheduled tests. Others still depend on human judgment or contract. This work sorts one from the other.
| Commitment | Documentary form | Testable form |
|---|---|---|
| Data minimisation | A statement of what is collected | Field-level inventory from live schemas and logs, compared against the declared set |
| Purpose limitation | A purpose clause | Access logs showing which services and people read each category, mapped to declared purpose |
| Retention | A published period | Scheduled queries finding records older than the period in every store, including backups and exports |
| Deletion | A promise on request | A seeded test subject deleted end to end, then searched for across primary, analytics, backup, and vendor systems |
| Third-party sharing | A vendor list | Egress monitoring and contract mapping showing where categories actually travel |
| Re-identification risk | An anonymisation assertion | Linkage testing against available auxiliary data |
Deletion is the sharpest test
inference
Deletion runs into every weakness at once: unknown copies, undocumented vendors, excluded backups, ownerless analytics pipelines, and data derived from the original record. If deletion works across all of them, the organisation probably has a working data map.
This makes deletion verification a possible leading measure of a privacy program. It remains untested. Platform choice may explain the result better than program quality does.
What would prove us wrong?
unknown
The pillar assumes engineered privacy reduces harm more than documentary privacy. Several findings would challenge that.
- Enforcement and harm data showing that actual privacy incidents arise overwhelmingly from access control and breach, not from the collection, retention, and sharing gaps this pillar studies.
- Evidence that continuous privacy testing produces high false-positive volume that crowds out the incidents that matter.
- Regulatory outcomes where documentary compliance reliably mitigated penalties regardless of observed data handling.
Put this to work
Research decision record
Use the question “Can we prove that data is handled the way our privacy documents claim?” on a real case and produce a record another person can challenge.
- For
- Practitioners, researchers, founders, and operating leaders.
- What you keep
- A research decision record you can review, revise, and send.
- What counts as sound
- Answers a named decision
- Separates evidence from assumptions
- Includes the strongest contrary case
- Names missing evidence
- Ends with a test, owner, and date
The result is a working analysis. Check it against source evidence and qualified judgment.
Nothing entered here is stored or sent. Review the prompt before sharing confidential, personal, patient, or privileged information.
Review the prompt
You can leave any field blank. The prompt will mark it as not provided.
If the record survives your review, send the question, evidence, unknowns, and requested next step.
Experiments for this pillar
- End-to-end deletion verification
Does a deletion request remove the data everywhere the notice implies?
- Consent enforcement probe
Does a withheld consent change what downstream systems do?
Patterns and anti-patterns
Anti-pattern
Treating the privacy notice as a description of the systems
The notice states intent. Field inventories, access logs, retention queries, and deletion tests state practice. Where they disagree, the systems are the fact.
Evidence for this pillar
- HHS, HIPAA Privacy Rule
The documentary baseline against which observed data handling is compared in healthcare settings.
- European Data Protection Board guidelines
Interpretation of purpose limitation, minimisation, and erasure, which the privacy experiments test against systems.
- NIST Privacy Framework
A structure for privacy outcomes that can be mapped to engineered tests.
Notes under this pillar
Design Patterns
- Deletion is the sharpest privacy test
A verified end-to-end deletion exercises the data map, the vendor list, the backup policy, and the derived-data problem at once. Few organisations pass it on the first attempt.
2026-09-15
Operating Theorys
- Consent language without enforcement is a claim about intent
If withholding consent does not change what a system does with a record, the consent mechanism only keeps a record of the choice. It does not enforce it.
2026-09-15
- Backups are usually out of scope, and usually full of the data
Retention and deletion policies often exclude backups for practical reasons. The exclusion is defensible. Leaving it unstated in the notice is not.
2026-09-15