Privacy by Design
Jan Wellergård
Agenda
Impact of failing to protect Personal Data
What does this mean?
Current laws
Some terms used in Data Protection
8 Principles (UK–act)
7 Foundational Principles PbD
1. Proactive not Reactive; Preventative not Remedial
2. Privacy as the Default Setting
3. Privacy Embedded into Design
4. Full Functionality — Positive-Sum, not Zero-Sum
5. End-to-End Security — Full Lifecycle Protection
6. Visibility and Transparency — Keep it Open
7. Respect for User Privacy — Keep it User-Centric
Questions?
More reading
Links if you have a lot of time on your hands
Contact

5. End-to-End Security — Full Lifecycle Protection
Strong access management procedures
Only grant access to those who need – review
Tailor Access Control profiles to the tasks of the user
Encryption in transit and at rest
Purge/Culling/Deletion of personal data
Clear understanding of the purpose of the system
Removal/Deletion/Archiving
Deletion vs. Anonymization
Using PII as keys (like customer ID) in the DB
How much data do we need to remove?
Having control over changes (scope creep)