Privacy by design

A Guide for Start-ups

PRIVACY

Privacy partially overlaps with security (confidentiality) but may also take the form of bodily integrity (inviolability of the physical body).

THE GOOD
THE BAD
THE UGLY

the BAD

AIL statistics 2015

the good

General Data Protection Regulation

• Europe wide harmonisation
• stronger responsibility & DPIA
• administrative sanctions
• right to be forgotton
• data portability
• privacy by desgin/default

the ugly

Untitled Slide

DESIGN

Creation of a plan for the construction of a system, considering the aesthetic, functional, economic and sociopolitical dimensions

Real-life privacy

Forget about law
privacy is too important to keep it to lawyers ;)

secure coding

Phases

• Architecture
• Design
• Implementation
• Operation
• Testing
• Maintenance
• Evaluation

architecture

KEY decisions

• Program organisation (modules)
• Major data structures
• Key algorithms
• Error processing
• Active or passive privacy
• Fault tolerance

PRINCIPLES

• "working backwards"
• know your ennemy
• chain of trust
• Auth/Aut/Acc/Aud
• Res/Recog/Recov
• Fail/degrade safely

principles (2)

• event repeatability
• multi-layer defense
• KISS (modularise)
• Seek statelessness
• Reuse code
• Address "weak links"

DESIGN

principles

• DPIA
• Compartmentalization

IMPLEMENTATION

PRINCIPLES

• Handle data with care
• Thoroughly review
• Use checklists
• Create maintainable code
• Reuse code

OPERATIONS

PRINCIPLES

• Harden network / connections
• Secure OS
• Deploy carefully
• Sound operation practices

Phases

• Architecture
• Design
• Implementation
• Operation
• Testing
• Maintenance
• Evaluation

Untitled Slide

Resources

OECD Privacy Guidelines

• Collection Limitation Principle
• Data Quality Principle
• Purpose Specification Principle
• Use Limitation Principle
• Security Safeguards Principle
• Openness Principle
• Individual Participation Principle
• Accountability Principle

Untitled Slide

Untitled Slide

Thank YOU