Privacy by Design

00:01

Welcome to module 3.12 privacy by design.

00:07

During this module will discuss the basics and objective of privacy by design. Or PBD.

00:11

We'll explore the seven principles of PBD and analyze privacy by design in practice.

00:19

So privacy by design is a concept developed back in the 90s by Doctor and Cava Kian

00:24

in Ontario Canada

00:26

to address the ever growing and systemic effects of information and communication technologies and of large scale network data systems.

00:34

So that statement is going to make a whole lot more sense. After review the seven principles here,

00:40

there's Dr ANne and I like this photo of her because of the customized license plate she has in her office. It doesn't look like it's had much use. That would be neat to see that in action.

00:54

So PPD objective,

00:56

Ensuring privacy and gaining personal control over one's information and for organizations to gain a sustainable competitive advantage. So you can see the objective very much aligns with a lot of the privacy goals that we discussed in Module two.

01:12

So the first principle of PBD is

01:15

proactive, Not reactive preventative, not remedial privacy by design comes before the fact, not after

01:23

the second principle privacy as the default setting, no action is required on the part of the individual to protect their privacy. It is built into the system

01:32

by default.

01:34

Third principle privacy embedded into design, privacy is integral to the system without diminishing functionality.

01:42

Fourth principle

01:45

full functionality positive. Some not zero sum privacy by design avoids the pretense of false dichotomies, such as privacy versus security, which we spoke about during the security module,

01:57

demonstrating that it is possible to have both.

02:01

Fifth principle and to end security. Full lifecycle protection privacy by design ensures secure and and management of information.

02:12

six principal visibility and transparency. Keep it open.

02:15

Its component parts and operations remain visible and transparent to all users and operators.

02:23

Seventh principle, respect for user privacy, keep it user centric requires architects and operators to offer such measures as strong privacy defaults, appropriate notice and empowering user friendly options.

02:37

So one thing I wanted to point out is, G D P R is very consistent with P with P B D. Article 25 has data protection by design and by default identified their emphasizes privacy protection by default throughout the GPR and recital 78 appropriate technical and organisational measures.

02:57

So what does this mean? What PBD is embedded into G D P. R and will likely be for future privacy regulations. So for those of you who are relatively new to PBD or maybe aren't completely up to speed on GDP are strongly encourage you to review the principles and when you're looking at

03:14

new regulations that are coming out or if you're considering

03:16

a painting on regulations, I would strongly encourage you to look at the impacts of PBD and how that would impact any any legislation or how that decision would be applied to your organization if that regulation came to fruition.

03:35

So PPD in action.

03:36

So if you're developing software or have the internet of things going on your network, social media sites, websites, electronic forms Crn, which our client relationship management systems,

03:46

you definitely want to have PBD be top of mind during these items. For example, Internet of Things has proliferated a lot of home and work networks out there.

04:00

And uh, it's important to note that not all are created equal. There are some privacy

04:09

by default, for example, and other privacy settings that simply just are not available in certain internet of things. So it's important to make sure that you review those before you potentially plug them into your network or you have properly trained your end users on some of the pros and cons of using

04:27

said devices when you're creating electronic forms, for example,

04:30

uh have a redaction like when you're typing a password and when you're typing in a sensitive information, maybe having that information redacted and having a little I next to it so you can review that information and unmask that information so it can't be viewed by someone

04:47

uh watching the information being typed in is important

04:51

separation of consumers from one region from another. For example, EU consumers may not have data captured as non EU consumers. So this is a workflow statement here when you're developing how information flows, how it's been captured from a website, it's important to note that you're not necessarily inter mixing uh

05:12

information from

05:13

Maybe one individual's data from a highly regulated area to another.

05:20

And and that shows that you're taking that privacy consideration in

05:26

by designing of capturing that information versus trying to prescribe it. After the fact

05:34

quiz question, privacy by design originated in what country?

05:43

Well, the answer is Canada.