What is privacy by design and privacy by default in GDPR?
That’s a big topic, and it can be challenging to understand all the ins and outs. But we’ll go over what privacy means for your company in general and any technology or GDPR context you might need!
Privacy has many dimensions: economic (the right incentives), social(inclusive measures), political values like free speech, etcetera… So let me start by explaining how each affects the data protection Act differently.
What does privacy by design mean?
GDPR privacy by design is an Article 25 obligation to ensure privacy and data protection in the processing activities of personal data. The law mandates companies to address privacy and data protection issues in the design phase of any project, product, service or system. Data protection by design is ultimately an approach that ensures you ‘bake in’ data protection into your processing activities and business practices. In short, GDPR’s Privacy by design can be achieved by:
- Deploying appropriate technical and organisational measures designed to implement data protection principles and,
- Integrate data security safeguards into the processing activities so that companies meet the GDPR’s compliance and protect the rights of their customers.
What does privacy by default mean?
GDPR privacy by default is another obligation of Article 25, which requires companies to restrict their data processing activities only if necessary for a specific goal. In particular, Data protection by default requires business entities to collect data for a legitimate interest, specifying that data before its processing starts, timely inform data subjects before collecting this data, and the only process the data needed for the specific purpose. This principle also highlights the involvement of data minimisation and purpose limitation, which are the vital requirements of GDPR. In brief, privacy by default can be achieved by:
- We implement data privacy-first procedures and strategies with default systems and business application settings.
- Ensuring a business does not provide the illusion of choice to individuals relating to the data they will process. This means that individuals require no action to maintain their privacy as it is already built into the system by default.
- Limiting the processing activities for any additional data unless the individual provides their consent.
- Make sure that the personal data of any individual is not automatically made publicly available to others unless that individual decides to make it so and,
- Providing individuals with enough controls and options to exercise their rights.
What is the difference between privacy by design and default?
The difference between privacy by design and privacy by default is that privacy by design is the requirement to address privacy in the early designing phase of any product, service, or project. Often this will be at the same time that a data protection impact assessment (DPIA) is handled by the business entities, enabling it to identify and assess the data privacy risks and challenges associated with the product, service or project and how these can be best mitigated.
Privacy by default requires that user settings should have the most privacy-friendly setting as the default setting. Under the GDPR, companies are obligated to implement appropriate organisational and technical measures by default, for example, data minimisation, i.e. only personal data which is necessary for each specific purpose of the processing is processed. For addressing privacy by default, there is a greater importance on employing data minimisation techniques such as pseudonymisation so that only the minimum amount of data required is collected and processed.
Seven foundational principles of privacy by design
The concept of privacy by design contains seven underlying principles that explain how to achieve data privacy compliance in the early stages of any projects, systems or services. These seven principles are as follows:
1. Proactive, not reactive/preventative, not remedial
The first principle, i.e. Proactive, not Reactive/Preventative, not Remedial, states that data privacy needs to come up at the initial stage of the planning process. If an organisation’s robust security measures consist of putting out fire extinguishers and dealing with data breaches, then the organisation is being reactive. This principle sets up the foundation of the rest of the principles by developing a culture of ‘privacy awareness’ across the board.
2. Privacy as the default
The second principle is privacy as default, meaning privacy must be at the forefront of what an organisation does with any data processing. It requires restricting mass data sharing, using data minimisation, deleting data that is no longer in use, and involving personal data processing on a legal basis. It also means using opt-in and opt-out rights for data subjects and data security safeguards for privacy considerations.
3. Privacy embedded into the design
The third principle is the idea about privacy needs and concerns during the designing phase of any project, product, system or service. In other words, data privacy is a core functionality of the product. Organisations should deploy encryption at rest and in transit, authentication and authorisations, testing vulnerabilities and conduct penetration tests regularly. It doesn’t matter if a product satisfies clients’ requirements, as there will be a greater risk if it bears a design flaw that leads to severe security vulnerability.
4. Full functionality
Principle four seeks to accommodate all legitimate interests and objectives in a “win-win” manner, requiring a balance between growth and security. It states that if a business entity reduces privacy functionality, that business is doing it wrong. Adopting appropriate technical and organisational measures to achieve the ideal state of security and confidentiality required by its business infrastructure should be needed. The involvement of data privacy should not overshadow the functionality of the business.
5. End-to-end security
The fifth principle talks about the End-to-End security principle. There is a long debate that data protection follows data throughout its whole lifecycle, i.e. from collection to deletion or removal. Encryption and authentication are the standards at every stage of data processing, but data protection also needs to go beyond other stages. Let us take an example as an organisation that should only collect data they need for a specific purpose and have a legal basis for processing. And when the organisation has achieved that particular purpose and is finished with the data, that organisation should use GDPR-compliant deletion methods for end-to-end data protection. So before collecting any data, there should be decided the retention period and data deletion mechanism of that data.
6. Visibility and transparency
Principle six of the Privacy by design addresses visibility and transparency. Data subjects should know about the privacy and processing practices of the organisation, and it should be shared in the open either in its website privacy policy or at the time of collecting data from data subjects. This principle supports the need for a well-written Privacy Policy, which is essential for every business to fall under the jurisdiction of the GDPR or other laws like CCPA, PIPEDA or Swiss data protection laws. It also argues that there needs to be a mechanism for data subjects to share their concerns over personal data, ask questions, and practice their rights given by the respective law.
7. Respect for user privacy
Finally, principle seven concludes the concept of privacy by design, that everything needs to be done by putting the data subject or customer at the heart of any development process. It means acknowledging that even if a company collects data from their clients or customers, it belongs to them from whom a company have collected.
All data subjects can make requests to access and withdraw their consent for the use of their data. Suppose their data is to be re-used for any different purpose other than that for which it was initially collected. In that case, the company needs to inform its customers again of the new purpose of data processing.
Why do companies need to implement this?
The concept of privacy by design can be explained by its name as, after all, who on this planet would want to have their data monitored or get compromised. Well, no one wants that to happen, and for that business, entities need to work pro-actively about designing frameworks or implementing data privacy policies and procedures from scratch.
Privacy by design framework ensures that data protection and security are embedded throughout the entire life cycle of systems and services, from the early design stage through deployment, use and ultimate disposal or disposition.
Data privacy is a major concern these days as of the growing development of regulations and laws in different jurisdictions, namely the US, Europe and Asia. The business that lies in these jurisdictions needs to comply whether they reside in that specific jurisdiction or not. The scope of these laws is much more enormous, and any business deals with the data of their consumers, customers or data subjects need to address data protection and privacy mechanisms at some level.
If data privacy is not addressed at the initial stage of any data processing, there is a chance that companies would require a lot of technical resources and human effort to assess and mitigate privacy risks for the developed projects. Moreover, many businesses would fall under the penalty of significant laws like GDPR if they processed their data and did not put privacy risks on the frontline.
The idea is to build privacy and data protection principles directly into technology, systems and practices at the design phase and default settings, thereby ensuring privacy and appropriate controls from the origin.
