Privacy Day 2022: What engineers should watch for in data protection

For Cloudflare, Data Privacy Day is a chance to look back at how the privacy landscape shifted over the past year and where it's heading. In 2021, the big themes were security as a privacy mechanism, data localization, and a wave of new regulations. Expect all of them to stay central in 2022.

Security as a layer of privacy

Cloudflare’s approach to privacy starts from the premise that less personal data flowing across the Internet is inherently better. That drove the development of 1.1.1.1, its public DNS resolver that doesn't retain personal data from requests, and Oblivious DNS over HTTPS (ODoH), a proposed standard that separates IP addresses from queries so no single party sees both.

In 2022, that work extends to Oblivious HTTP (OHTTP), which applies the same principle to general HTTP traffic. OHTTP is being developed in the IETF’s OHAI working group. It lets a client make requests to a server without the server linking those requests back to the client or to each other.

Still, retaining identity is sometimes necessary — for example, when employees are connecting to an internal network from home. That's where Zero Trust comes in, and Cloudflare argues organizations don't have to choose between securing those connections and protecting employee privacy. One concrete outcome from 2021 is Selective Logging in Cloudflare Gateway. Gateway admins can now disable logging entirely, log only blocked actions, or disable logging for personal information. If an enterprise chooses not to collect certain data, that data can't be stolen, leaked, or misused. Gateway still blocks malware, phishing, and command-and-control URLs per policy.

The Log4j vulnerability (CVE-2021-44228) was a stark reminder that security is itself a privacy control. An attacker exploiting Log4j could execute code remotely, and not just on Internet-facing Java software — a malicious User-Agent string could be logged by a backend Java system doing indexing or data science, making any system that touches untrusted input potentially reachable. From there, an attacker could exfiltrate data from web servers or from non-Internet-facing databases such as billing systems. Because of Log4j’s ubiquity, millions of users' personal data was exposed.

Cloudflare responded with WAF rules that were rolled out within hours of disclosure. Customers using Cloudflare Access could also lock down attack surfaces, and the network-level visibility across a huge number of applications allowed Cloudflare to spot WAF evasion patterns and exfiltration attempts quickly, helping customers identify attack vectors on their own infrastructure. A notable point in Cloudflare's post-mortem is that forced data segmentation by jurisdiction would have made this kind of rapid global response much harder.

Data localization and the EU debate

In the EU, data localization entered 2022 with a bang. Austria’s data protection authority ruled on January 13 that a European company using Google Analytics was in breach of GDPR, as interpreted by the Court of Justice of the European Union's 2020 "Schrems II" decision, because EU personal data was being transferred to the United States.

Cloudflare disputes the view that Schrems II bans such transfers. It points to safeguards that can make transfers compliant under the EU Standard Contractual Clauses (SCCs), which the company says it has updated its Data Processing Addendum to reflect. Cloudflare also cites its ISO 27701 certification, which maps to GDPR requirements, plus additional measures aligned with the EDPB’s June 2021 Recommendations on Supplementary Measures.

Still, recognizing that some customers want their EU personal data to remain in-region for industry-specific reasons, Cloudflare built its Data Localization Suite. The flagship component is the Customer Metadata Boundary, which lets EU customers keep customer-identifiable end-user log data in the EU without losing the security services they depend on. The suite is expected to expand to other regions in 2022.

Third-party tools and privacy-first analytics

Trackers — cookies, web beacons, and the like — remain a mainstay of the web, but Cloudflare's thinking on analytics favors a server-side approach. The company launched Web Analytics in 2020, allowing sites to gather data without any client-side code.

When third-party tools do need to run, Cloudflare's Zaraz product is worth watching as a pattern. By moving third-party tool execution onto Cloudflare's network, Zaraz reduces the amount of client-side code a site must ship. This both improves performance and gives website operators control over what data is actually sent to providers. If a tool attempts to collect personal data — such as IP addresses or URL query strings — the operator can strip it at the edge before the data moves downstream.

Regulatory shifts beyond the EU

The regulatory calendar for 2022 is dense, and some of the most consequential changes take effect in 2023 but require action starting now.

  • The California Privacy Rights Act (CPRA) takes effect January 1, 2023. Crucially, it includes retrospective requirements, meaning companies must apply its rules to personal data collected as of January 1, 2022.
  • Virginia’s and Colorado’s privacy laws also come into force in 2023.
  • Florida, Washington, Indiana, and the District of Columbia have proposed their own privacy legislation.

Beyond the U.S., countries are debating whether data protection laws should expand beyond personal data. In India, a parliamentary committee recommended renaming the “Personal Data Protection Bill” the “Data Protection Bill” and extending protections to non-personal data. The EU’s Data Strategy likewise aims to build a framework that encourages broader data sharing.

Two laws to watch in 2022 are Japan’s amended Act on Protection of Personal Information (APPI) — with new requirements for cross-border transfers and data breach notifications — and Thailand’s Personal Data Protection Act (PDPA), a GDPR-style framework that allocates obligations to organizations collecting, processing, and transferring personal data. With all of these changes and an active privacy technology roadmap, 2022 will be a pivotal year for how data protection is engineered and regulated.