Compliance as Baseline, or Striving for More? How Privacy Engineers Work and Use Privacy Standards

The privacy field is becoming more rigorous and standardized with privacy engineers (PEs) playing key roles in the process. Yet, privacy engineering remains vaguely defined, and privacy standards remain far from the wide demand and acceptance of security standards like ISO 27001 or FedRAMP. To better understand the work PEs do, and how privacy standards fit in, we conducted an interview study with (n=14) privacy engineers. The findings revealed two new roles PEs fulfill: (1) Liaison between Legal and Engineering teams, and (2) Educator. We found that PEs are often too caught up in baseline legal compliance issues to think about implementing more ambitious privacy goals. The more senior PEs were more likely to have the need, flexibility, and resources to effect organizational change using privacy standards. This study provides timely information to ensure privacy standards remain current, relevant, and effective by detailing the challenges and opportunities PEs experience on the job generally, and with privacy standards specifically.