GDPR Privacy by Design Requirement
Article 25 of the GDPR requires organizations to implement privacy by design and by default (PbD), at appropriate points in the product development cycle. Data protection principles such as data minimization and pseudonymization are expected to be embedded to further protect data subjects.
What is Privacy by Design?
Privacy by design seeks to integrate privacy principles into the development of a business system or process. The concept was first published in the 1990s. It was adopted by the Federal Trade Commission in a privacy report issued in 2012, which called on companies to build in privacy protections at every stage in product development.
The 7 foundational principles of Privacy by Design set out by Ann Cavoukian are:
1. Proactive not Reactive; Preventative not Remedial
2. Privacy as the Default
3. Privacy Embedded into Design
4. Full Functionality – Positive-Sum, not Zero-Sum
5. End-to-End Security – Lifecycle Protection
6. Visibility and Transparency
7. Respect for User Privacy
Privacy by Default is its corollary within Article 25. It is the idea that the default settings for data collection, usage and sharing in a system or service are the most privacy friendly. After setting data protection by default, an organization can then give users the option to change those settings.
What are the GDPR Privacy by Design Requirements?
Article 25 of the GDPR requires privacy by design. Specifically, it requires the use of technical and organisational measures designed to implement data protection principles effectively and with the necessary safeguards to protect EU citizen rights and fulfill the GDPR requirements.
The GDPR also requires only necessary personal data be processed for each specific purpose. In other words, the amount of personal data collected should be limited to what is necessary, the extent of the processing should be limited, the period of storage should be limited and accessibility to the data should be limited. Appropriate technical and organizational measures must be put in place to ensure that it happens by default within the organization and the Article 30 documentation requirements concerning privacy by default are met.
Time frame of Privacy by Design
Article 25 of the GDPR specifically requires controllers to do so both at the time of the determination of the means of processing as well as at the time of the processing. The considerations of privacy during these periods should be documented pursuant to the requirements of Article 30.
In practice, privacy needs to be taken into consideration throughout the development of a business process or system in order to ensure that the rights of the data subjects are protected and the requirements of the GDPR are fulfilled.
Considerations in the Limitation of Privacy by Design
The GDPR permits a number of considerations in data protection to limit privacy by design. These include:
– the state of the art;
– the cost of implementation;
– the nature, scope, context and purposes of processing; and
– the risks to rights and freedoms posed by the processing.
Privacy by Design and Privacy by Default Certifications
Article 42 introduces a legal framework for certifications and seals for the purpose of demonstrating compliance. This certification is specifically referenced in Article 25 for its application to the principles of data protection by design and by default. However, at the time of writing of this information in April 2018, there have not been any approved certification mechanisms pursuant to Article 42.
Improve Data Privacy for GDPR or CCPA with Clarip
The Clarip team and enterprise privacy management software are ready to meet your compliance automation challenges. Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo or speak to a member of the Clarip team.
If compliance with the California Consumer Privacy Act is your focus until 2020, ask us about our CCPA software. Handle automation of data subject access requests with our DSAR Portal, or provide the right to opt out of the sale of personal information with the consent management software.
Need to improve your GDPR compliance solution? Clarip offers modular GDPR software that can fill in gaps in your privacy program. Choose from the data mapping software for an automated solution to understanding your data collection and sharing, conduct privacy risk assessments with DPIA software, or choose the cookie consent manager for ePrivacy.
Click here to contact us (return messages within 24 hours) or call 1-888-252-5653 to schedule a demo and speak to a member of the Clarip team.
Related Content
DPIA Software
Privacy Risk Assessments: DPIAs and PIAs