Privacy by design is a fairly old concept in systems engineering and its general meaning is pretty obvious.
Wikipedia describes it as “not about data protection” but rather “designing so data doesn’t need protection,” with the “root principle based on enabling service without data control transfer from the citizen to the system” (i.e. the citizen is not identifiable or recognizable).
In systems engineering this is demonstrated by GPS, for example, where your mobile can detect its geographical location without giving away that location or your identity.
What does privacy by design mean in the context of the GDPR?
Before we dive in, I should confess that to liven up this article, I have peppered it with crappy stock photos that represent privacy or data breaches. I hope you enjoy.
First off, it’s worth saying that privacy by design is a new part of EU regulations, contained in the GDPR. The EU Data Protection Directive does not refer to the concept, which means that until the GDPR comes into force in May 2018, data controllers simply have to take appropriate measures in order to protect personal data (not to design so it doesn’t need protection).
So what does the GDPR state? It’s worth reading paragraphs 1 and 2 of article 25, which I have reproduced here (skip them if you’re in a hurry):
- Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.
- The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons.
In short, the GDPR requires:..
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
