⚡ Pillar 1: Proactive, Not Reactive

A proactive approach means anticipating and preventing privacy problems before they occur, rather than scrambling to fix them after a breach. It means asking "what could go wrong with user data?" at the design stage — not after 10 million records have been stolen.

📖 Proactive Privacy Practices

Practice	What It Involves	Real-World Example
Privacy Impact Assessment (PIA/DPIA)	Before building a new feature, formally assess what personal data it collects, how it flows, what risks exist, and how to mitigate them. Required by GDPR for high-risk processing.	Apple conducts a DPIA for every new feature (e.g. Face ID, Apple Pay, Health app). Each assessment maps data flows and identifies risks before a single line of code is written.
Threat modelling for privacy	Use frameworks like STRIDE or LINDDUN (specifically designed for privacy) to systematically identify privacy threats during the design phase.	Microsoft requires STRIDE threat modelling for every product. Their Security Development Lifecycle (SDL) mandates that privacy threats are identified and mitigated before development begins.
Data flow mapping	Document exactly where personal data goes: collection point, storage location, processing steps, third-party sharing, deletion timeline.	Atlassian (makers of Jira/Trello) publishes data flow diagrams showing exactly where user data is stored, processed, and which third parties access it.
Regular privacy audits	Periodically review the system to ensure privacy protections are still effective and no new risks have emerged.	Google conducts annual privacy audits and publishes transparency reports. Their internal privacy team reviews product changes before launch.

⚠️ Case Study: Clearview AI — What Happens Without Proactive Privacy

Clearview AI scraped billions of photos from social media (Facebook, Instagram, YouTube) without anyone's consent to build a facial recognition database sold to law enforcement. They never conducted a privacy impact assessment. In 2022, the Australian Information Commissioner found Clearview AI had breached the Australian Privacy Act and ordered them to destroy all data collected from Australians. The UK fined them £7.5 million. France, Italy, and Greece also issued fines. A proactive approach — asking "do we have consent to collect this data?" before building the system — would have prevented the entire situation.