Research program
The dangers of data privacy theatre
Most privacy programs are documentary. Notices, consent language, contractual clauses, and a data inventory maintained by interview. This program studies privacy as an engineered property of running systems, where the claim in the notice can be checked against the behaviour of the data.
Can we prove that data is handled the way our privacy documents claim?
The gap between the notice and the system
Claim: observation
A privacy notice is a claim about collection, purpose, retention, sharing, and deletion. In most organisations nobody has tested that claim against the systems. Fields are added by product teams, copies accumulate in warehouses and analytics tools, vendors receive exports, and backups hold data long after the stated retention period.
The document is usually accurate about intent and frequently wrong about practice. That gap is not dishonesty. It is the ordinary result of documents being written once and systems changing weekly.
Privacy properties that can be tested
Claim: recommendation
Some privacy promises can become scheduled tests. Others still depend on human judgment or contract. This work sorts one from the other.
| Commitment | Documentary form | Testable form |
|---|---|---|
| Data minimisation | A statement of what is collected | Field-level inventory from live schemas and logs, compared against the declared set |
| Purpose limitation | A purpose clause | Access logs showing which services and people read each category, mapped to declared purpose |
| Retention | A published period | Scheduled queries finding records older than the period in every store, including backups and exports |
| Deletion | A promise on request | A seeded test subject deleted end to end, then searched for across primary, analytics, backup, and vendor systems |
| Third-party sharing | A vendor list | Egress monitoring and contract mapping showing where categories actually travel |
| Re-identification risk | An anonymisation assertion | Linkage testing against available auxiliary data |
Deletion is the sharpest test
Claim: inference
Deletion runs into every weakness at once: unknown copies, undocumented vendors, excluded backups, ownerless analytics pipelines, and data derived from the original record. If deletion works across all of them, the organisation probably has a working data map.
This makes deletion verification a possible leading measure of a privacy program. It remains untested. Platform choice may explain the result better than program quality does.
What would prove us wrong?
Claim: unknown
The program assumes engineered privacy reduces harm more than documentary privacy. Several findings would challenge that.
- Enforcement and harm data showing that actual privacy incidents arise overwhelmingly from access control and breach, not from the collection, retention, and sharing gaps this program studies.
- Evidence that continuous privacy testing produces high false-positive volume that crowds out the incidents that matter.
- Regulatory outcomes where documentary compliance reliably mitigated penalties regardless of observed data handling.
Experiments for this program
- End-to-end deletion verification Does a deletion request remove the data everywhere the notice implies?
- Consent enforcement probe Does a withheld consent change what downstream systems do?
Patterns and anti-patterns
- Treating the privacy notice as a description of the systems (anti-pattern)
Evidence for this program
- HHS, HIPAA Privacy Rule The documentary baseline against which observed data handling is compared in healthcare settings.
- European Data Protection Board guidelines Interpretation of purpose limitation, minimisation, and erasure, which the privacy experiments test against systems.
- NIST Privacy Framework A structure for privacy outcomes that can be mapped to engineered tests.
Research notes
Backups are usually out of scope, and usually full of the data
Retention and deletion policies often exclude backups for practical reasons. The exclusion is defensible. Leaving it unstated in the notice is not. Backups usually hold the data a policy says is deleted, so a privacy notice that is silent about them misleads the people it describes.
Consent language without enforcement is a claim about intent
If withholding consent does not change what a system does with a record, the consent mechanism only keeps a record of the choice. It does not enforce it.
Deletion is the sharpest privacy test
A verified end-to-end deletion exercises the data map, the vendor list, the backup policy, and the derived-data problem at once. Few organisations pass it on the first attempt.