In this day and age, it is virtually impossible to tell where one computer ends and another begins.
In this day and age, it is virtually impossible to tell where one computer ends and another begins. By implementing fair information practices, specifically simplified choice and transparency, we can increase trust in the data collectors, and create confidence in the market.
Privacy design strategies were developed because existing design patterns and privacy-enhancing technologies were not comprehensive enough to cover the entire system development process. Privacy Design Strategies are of two types: Data-oriented strategies and Process-oriented strategies.
Data-Oriented Strategies are more technical and are about privacy-friendly processing of data. They are 4 in number.
MINIMISE
Personal Data should be processed if and only if necessary.
SEPARATE
Data collected for one purpose should be stored separately from data stored for another purpose, and linking of these database tables should not be easy.
ABSTRACT
When data about individuals is not necessary for the purpose, only aggregate data should be stored.
HIDE
Protect personal data, or make it unlinkable or unobservable. Make sure it does not become public or known. Personal data should be properly protected, and strict access control procedures should limit access to authorised persons only.
Process Oriented Strategies are more theoretical and are about procedures organisations need to have in place. They are also 4 in number.
INFORM
A data subject should be informed about the fact that data about her is being processed, and she should be able to request modifications and corrections where appropriate.
CONTROL
Provide data subjects adequate control over the processing of their personal data.
ENFORCE
The collection and processing of personal data should be done in accordance to a privacy policy, that should be actively enforced.
DEMONSTRATE
Demonstrate you are processing personal data in a privacy-friendly way. The current proposal for the revision of the European privacy directive also stresses the fact that data controllers should be able to demonstrate compliance with data protection protocols.
Representing all stakeholders involved - including system owners, technical experts, and the end users (potential data subjects) ensures a holistic design process and risk analysis encompassing all perspectives of both data controllers and data subjects. In fact, one can apply the privacy design strategies iteratively. Attention must be given not just to ordinary data, but also to Metadata that may be inadvertently collected. Finally, applying the privacy design strategies to individual components of the overall system instead of the system as a whole can help make your system more user privacy-friendly.
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
