The document discusses the need for data scientists to develop stronger privacy skills and knowledge. It notes that while most data scientists accept the importance of privacy, the profession overall lacks in-depth understanding of privacy principles and regulations. As data science tools are used for more high-risk applications and public concern over data privacy grows, it is essential for data scientists to learn about privacy challenges and solutions. The document provides a knowledge map to help data scientists and organizations assess privacy skill levels and identify training needs for different roles.

1. FEATURES
A DETAILED PRIVACY
KNOWLEDGE MAP
FOR DATA SCIENCE
DATA SCIENCE
A Professional's Guide to Essential Privacy Knowledge
Skills For Minimizing Privacy Risk in Data Science Product and Service Development

2. Iapp.org
Data science has unlimited potential as a business and scientific tool.
All it needs to fulfill its promise is, obviously, data.
That often means personal data collected online and by personal
devices. Intimate facts and details sent over public networks, merged
into bigger and bigger data sets, and used to peer deeper into
consumer behavior – exactly what consumers are worried about.
Legislators and regulatory officials have responded by steadily giving
consumers more legal rights to restrict the collection and use of their
data. Data science could be one monumental scandal away from a
plunge in opt-in rates that chokes off critical information flows.
“As we throw more technology and processing power at answering
questions, the potential for harm has risen. If consumers lack trust,
there will be an increase in requests for data deletion and
rectification,” said Aurelie Pols, founder of Aurelie Pols and
Associates, a digital strategy consultancy. With backgrounds in data
analytics and privacy, she sees mounting privacy challenges for the
data science profession.
“For example, there is growing concern about predictive analytics, and
not enough discussion about false positives and negatives. When I use
data to predict if you prefer a banana milkshake or a strawberry
yogurt, there are no serious consequences. If I get nine out of ten
right, that’s fine. But if law enforcement is using data science to
determine guilt or innocence, and someone could get a 10-year jail
sentence, the certainty has to be beyond 99.9 percent. The stakes are
getting much higher and the pendulum is swinging back toward
privacy,” Pols said.
The best way for data scientists to head off a full-on consumer
backlash is to show they can be trusted to use sensitive information
responsibly. To do that, they have to learn privacy.

3. GETTING PAST ‘NO’
Although consumer unease drives personal data regulation,
consumers are not the first audience data scientists have to win over.
Data scientists don’t usually get data directly from consumers. They
have to ask customer-facing departments like sales and customer
service for permission to access personal data. Then they need IT
departments to grant that access.
Departments that collect and control data are also responsible for
meeting legal and regulatory privacy requirements. They are
answerable to executives, customers and regulators for privacy and
security incidents. They are unlikely to share sensitive data with data
scientists who have little or no working knowledge of privacy,
according to Katharine Jarmul, principal data scientist at global
software consultancy Thoughtworks.
“The key to avoiding ‘no’ conversations with people who control data
is awareness of privacy technology and law. If data scientists
understand privacy, they can get into back-and-forth conversations
about data access rather than just hitting a wall. Then they can turn
‘no’s’ into ‘maybes’ and ‘yesses,’” Jarmul said. “There is a lot of upside
for data scientists who understand privacy. If they can go into
conversations with data controllers with recommendations about
privacy technologies and techniques, it will help them access data
they have been refused in the past.”
International Association of Privacy Professionals
MAP YOUR
PRIVACY SKILLS
The knowledge map “Data Science
Pros: Build Your Privacy Muscle”
ranks privacy skills as “need to
know,” “should know,” “good to
know,” and “non-essential” by
position. Individual data scientists
can use it to discover which privacy
training they need in their
positions. Directors, managers and
executives can map out
organization-wide privacy learning
strategies and plan targeted
training for their staffs.
Visit iapp.org/training
for more information.
Privacy can be an exciting part of
data science – an interesting
technical problem to solve. It’s not
just a stodgy, boring issue for lawyers.
Katherine Jarmul,
Principal data scientist, Thoughtworks
“
”

4. DATA SCIENCE’S PRIVACY DEFICIT
In a profession fascinated by mathematical and technical challenges, it is not surprising to find
attitudes toward a seemingly peripheral subject like privacy ranging from acceptance to hostility. The
former is more common. The latter is primarily among those who see privacy as an obstacle to tapping
new data sources, or who have had bad experiences with other departments, according to Jarmul.
Across the profession, however, most data scientists accept the practical and ethical need to
understand privacy, according to Rebecca Weiss, former director of data science at Mozilla. The
problem is that most data scientists lack working knowledge of data privacy principles.
“I’ve never met a data scientist who is cavalier about privacy. But when it comes to deeper knowledge
and skills, we are not there yet,” Weiss said. “Considering the impact of laws like the GDPR and CCPA,
and the global outlook for more privacy regulation, as a profession we need more knowledge. If
compliance requirements change and that affects how you have to manage your data, you have to
recognize that something has changed and respond.”
Data scientists do not have to be privacy experts any more than lawyers need to be technology
experts. But just as lawyers involved in product development should understand relevant technology
principles, so should data scientists need to know laws and regulations that apply to their roles. A data
modeler, for example, needs only a passing knowledge of law and policy but should be well-schooled in
privacy by design. Consult the accompanying knowledge map to see which privacy skills align with
specific data science roles.
With data science’s role in business growing and the public’s skepticism rising, creating top-to-bottom
privacy skills and knowledge in data science departments is essential.
“Companies that are dealing with user-level information and haven’t factored privacy into their
long-term planning are in danger. Especially medium and small companies, because of the fines they
face,” Weiss said. “If you are a data scientist asking other parts of the company for access to their
data, they will ask you what you’re going to use their data for, and what you’ve done to ensure privacy
in your products.”
International Association of Privacy Professionals
Considering the impact of laws like the GDPR
and CCPA, and the global outlook for more
privacy regulation, as a profession we need
more knowledge.
Rebecca Weiss
Former director of data science, Mozilla
“
”

5. Chief Data Scientist/VP/Director
Data Scientist Manager
Data Scientist/Engineer
Decision Intelligence Scientist
Data Modeler
Data Analyst
Data Architect
Big Data Engineer/Developer
Artificial Intelligence Architect/
Developer/Manager
Statistician
Data Center/Warehouse Manager
Database Manager/Developer
Business/Operations Analyst
Machine Learning Engineer
Marketing Analyst
Systems Analyst
DATA SCIENCE PROS: BUILD YOUR PRIVACY MUSCLE
Use this knowledge map to assess individual and team privacy skill sets and develop a road map for professional development.
iapp.org
NON-ESSENTIAL
GOOD TO KNOW
NEED TO KNOW SHOULD KNOW
P
R
I
V
A
C
Y
T
H
R
E
A
T
S
A
N
D
V
I
O
L
A
T
I
O
N
S
C
o
l
l
e
c
t
i
o
n
,
u
s
e
,
d
i
s
s
e
m
i
n
a
t
i
o
n
,
i
n
t
r
u
s
i
o
n
a
n
d
s
o
ft
w
a
r
e
s
e
c
u
r
i
t
y
F
O
U
N
D
A
T
I
O
N
A
L
P
R
I
N
C
I
P
L
E
S
B
u
i
l
d
s
t
r
o
n
g
p
r
i
v
a
c
y
/
d
a
t
a
p
r
o
t
e
c
t
i
o
n
m
e
a
s
u
r
e
s
t
h
r
o
u
g
h
o
u
t
t
h
e
p
r
o
d
u
c
t
l
i
f
e
c
y
c
l
e
R
O
L
E
O
F
T
E
C
H
I
N
P
R
I
V
A
C
Y
F
u
n
d
a
m
e
n
t
a
l
s
o
f
t
e
c
h
-
r
e
l
a
t
e
d
p
r
i
v
a
c
y
;
i
n
f
o
s
e
c
u
r
i
t
y
;
p
r
i
v
a
c
y
r
e
s
p
o
n
s
i
b
i
l
i
t
i
e
s
o
f
t
e
c
h
p
r
o
f
e
s
s
i
o
n
a
l
s
P
R
I
V
A
C
Y
B
Y
D
E
S
I
G
N
M
e
t
h
o
d
o
l
o
g
y
p
r
o
c
e
s
s
;
i
n
t
e
g
r
a
t
i
n
g
p
r
i
v
a
c
y
t
h
r
o
u
g
h
o
u
t
p
r
o
d
u
c
t
d
e
v
e
l
o
p
m
e
n
t
l
i
f
e
c
y
c
l
e
s
;
e
s
t
a
b
l
i
s
h
i
n
g
p
r
i
v
a
c
y
f
r
a
m
e
w
o
r
k
a
n
d
o
n
g
o
i
n
g
r
e
v
i
e
w
P
R
I
V
A
C
Y
E
N
G
I
N
E
E
R
I
N
G
P
r
i
v
a
c
y
e
n
g
i
n
e
e
r
i
n
g
r
o
l
e
a
n
d
o
b
j
e
c
t
i
v
e
s
;
p
r
i
v
a
c
y
d
e
s
i
g
n
p
a
tt
e
r
n
s
;
s
o
ft
w
a
r
e
r
i
s
k
s
P
R
I
V
A
C
Y
-
E
N
H
A
N
C
I
N
G
T
E
C
H
N
O
L
O
G
Y
A
N
D
T
E
C
H
N
I
C
A
L
M
E
A
S
U
R
E
S
D
a
t
a
-
o
r
i
e
n
t
e
d
s
t
r
a
t
e
g
i
e
s
a
n
d
t
e
c
h
n
i
q
u
e
s
;
p
r
o
c
e
s
s
-
o
r
i
e
n
t
e
d
s
t
r
a
t
e
g
i
e
s
T
E
C
H
N
O
L
O
G
Y
C
H
A
L
L
E
N
G
E
S
F
O
R
P
R
I
V
A
C
Y
A
u
t
o
m
a
t
e
d
d
e
c
i
s
i
o
n
m
a
k
i
n
g
;
t
r
a
c
k
i
n
g
a
n
d
s
u
r
v
e
i
l
l
a
n
c
e
;
a
n
t
h
r
o
p
o
m
o
r
p
h
i
s
m
;
m
o
b
i
l
e
s
o
c
i
a
l
c
o
m
p
u
t
i
n
g
M
A
N
A
G
I
N
G
/
A
S
S
E
S
S
I
N
G
S
O
F
T
W
A
R
E
A
N
D
T
H
I
R
D
-
P
A
R
T
Y
V
E
N
D
O
R
S
P
r
i
v
a
c
y
a
n
d
i
n
f
o
r
m
a
t
i
o
n
s
e
c
u
r
i
t
y
p
o
l
i
c
i
e
s
;
w
h
e
r
e
p
e
r
s
o
n
a
l
i
n
f
o
i
s
h
e
l
d
,
w
h
o
h
a
s
a
c
c
e
s
s
/
v
i
e
w
;
d
e
l
e
t
i
n
g
d
a
t
a
f
r
o
m
v
e
n
d
o
r
s
y
s
t
e
m
s
I
N
C
I
D
E
N
T
R
E
S
P
O
N
S
E
I
n
c
i
d
e
n
t
r
e
s
p
o
n
s
e
p
l
a
n
n
i
n
g
,
d
e
t
e
c
t
i
o
n
a
n
d
h
a
n
d
l
i
n
g
D
A
T
A
,
S
Y
S
T
E
M
S
A
N
D
P
R
O
C
E
S
S
A
S
S
E
S
S
M
E
N
T
M
a
p
d
a
t
a
i
n
v
e
n
t
o
r
i
e
s
,
fl
o
w
s
a
n
d
c
l
a
s
s
i
fi
c
a
t
i
o
n
s
;
m
a
p
a
n
d
d
o
c
u
m
e
n
t
d
a
t
a
fl
o
w
;
a
n
a
l
y
z
e
a
n
d
c
l
a
s
s
i
f
y
t
y
p
e
s
a
n
d
u
s
e
s
o
f
d
a
t
a
R
I
S
K
A
S
S
E
S
S
M
E
N
T
T
y
p
e
o
f
d
a
t
a
b
e
i
n
g
o
u
t
s
o
u
r
c
e
d
;
l
o
c
a
t
i
o
n
o
f
d
a
t
a
,
i
m
p
l
i
c
a
t
i
o
n
s
o
f
c
l
o
u
d
c
o
m
p
u
t
i
n
g
s
t
r
a
t
e
g
i
e
s
;
r
e
c
o
r
d
s
r
e
t
e
n
t
i
o
n
;
m
e
d
i
a
s
a
n
i
t
i
z
a
t
i
o
n
a
n
d
d
i
s
p
o
s
a
l
;
d
e
v
i
c
e
s
e
c
u
r
i
t
y
D
A
T
A
L
I
F
E
C
Y
C
L
E
C
o
l
l
e
c
t
i
o
n
,
u
s
e
,
d
i
s
c
l
o
s
u
r
e
,
r
e
t
e
n
t
i
o
n
a
n
d
d
e
s
t
r
u
c
t
i
o
n
C
O
N
S
E
N
T
C
o
o
k
i
e
s
;
e
-
m
a
i
l
o
p
t
-
i
n
a
n
d
o
p
t
-
o
u
t
;
u
n
d
e
r
s
t
a
n
d
i
n
g
w
h
e
n
c
o
n
s
e
n
t
i
s
r
e
q
u
i
r
e
d
D
A
T
A
S
U
B
J
E
C
T
R
I
G
H
T
S
O
v
e
r
s
i
g
h
t
;
g
o
v
e
r
n
a
n
c
e
;
r
e
s
p
o
n
s
e
s
t
o
i
n
q
u
i
r
i
e
s
/
v
i
e
w
H
A
N
D
L
I
N
G
P
E
R
S
O
N
A
L
L
Y
S
E
N
S
I
T
I
V
E
I
N
F
O
R
M
A
T
I
O
N
C
o
l
l
e
c
t
i
o
n
,
p
r
o
t
e
c
t
i
o
n
,
d
e
s
t
r
u
c
t
i
o
n
,
a
c
c
e
s
s
,
d
e
l
e
t
i
o
n
a
n
d
r
e
t
e
n
t
i
o
n
p
o
l
i
c
i
e
s
D
A
T
A
C
O
L
L
E
C
T
I
O
N
L
A
W
S
S
t
a
t
e
-
a
n
d
c
o
u
n
t
r
y
-
s
p
e
c
i
fi
c
d
a
t
a
c
o
l
l
e
c
t
i
o
n
l
a
w
s
s
u
c
h
a
s
t
h
e
G
D
P
R
,
C
C
P
A
,
C
A
S
L
a
n
d
C
O
P
P
A
CIPM
CIPT CIPP
© Copyright IAPP 2021. All rights reserved.
Certified Information Privacy Professional
(CIPP) – Understand privacy laws and frameworks.
Certified Information Privacy Manager
(CIPM) – Manage privacy program operations.
Certified Information Privacy Technologist
(CIPT) – Use technology to solve privacy issues.

6. iapp.org
LEARNING PRIVACY
The current generation of data scientists haven’t had many opportunities to learn privacy. It is only starting to
make its way into college curriculums, so most data scientists with privacy skills are self- taught, Jarmul said.
Data science organizations that want to raise their privacy IQs will have to train their people themselves.
Fortunately, the profession is comprised of eager learners who like to burnish their credentials with training
and certifications.
“I am seeing a lot more data scientists with privacy-related certifications, coursework and self-training. It helps
prepare them to manage the laws and regulations that affect their work,” Jarmul said. “There are a lot of
regulations focused on data sovereignty, rights to explanations and data lineage that are relevant to data
science. Data scientists who understand the regulations can talk to data controllers realistically about how to
use sensitive data.”
Convincing data scientists that privacy training is worth their time is getting easier with each well-publicized
privacy breach, according to Pols.
“In my first year of teaching ethics at a university in Spain, students would ask why we had to talk about
privacy. They didn’t care,” Pols said. “Over the years, as there have been more and more privacy breach issues,
interest grew steadily. When Cambridge Analytica happened, that interest became concern. They wanted to
learn about legal and technological tools and how to work with other stakeholders to minimize harm.”
There are opportunities for privacy-savvy data scientists at all sizes of organizations, but particularly small and
medium-sized companies, Weiss said. Lacking the resources of large corporations, they can’t compete for
people with experience in data science and privacy. Privacy training creates openings for younger data
scientists just breaking into the field. It also gives experienced data scientists even more mobility in a market
desperate for their skills.
BENEFITS OVER HARM
Data science is capable of enormous societal good. It is an economic growth engine and a powerful tool for
public health, scientific discovery, and technological innovation. It is also at risk of developing a reputation as
a threat to personal data privacy.
The most effective way to re-focus attention on data science’s benefits is for data scientists to embrace
privacy as an ethical and professional obligation. Data scientists must be trained to anticipate the privacy
implications of new algorithms and applications and proactively offer solutions. They must question the
provenance of shared data, and whether they can legally and ethically process it the way they want. Such
knowledge, underpinning a sincere commitment to protecting personal privacy, will help ensure a steady flow
of new data that enables data scientists to do what they want most: find answers to the hardest questions.
“Privacy can be an exciting part of data science – an interesting technical problem to solve,” Jarmul said. “It’s
not just a stodgy, boring issue for lawyers.”

7. Iapp.org
ABOUT THE IAPP
The International Association of Privacy Professionals
comprises the foremost body of resources, knowledge and
subject matter expertise dedicated to helping define,
promote and improve the data protection profession
globally. As a not-for-profit association, the IAPP serves
corporate and individual members operating in diverse
functional areas – customer service, finance, human
resources, information security, legal, marketing, sales and
technology – so they can better navigate today’s
data-driven world. In addition to providing the only
globally recognized credentialing programs in
information privacy, the IAPP offers practitioners a forum
to share best practices, track trends, discuss and debate
issues, and provide education and guidance on
opportunities in the field.
© Copyright IAPP 2021. All rights reserved.