Privacy by design

Privacy by Design is an approach to systems engineering which takes privacy into account throughout the whole engineering process. The concept is an example of value sensitive design, i.e., to take human values into account in a well-defined manner throughout the whole process and may have been derived from this. The concept originates in a joint report on “Privacy-enhancing technologies” by a joint team of the Information and Privacy Commissioner of Ontario, Canada, the Dutch Data Protection Authority and the Netherlands Organisation for Applied Scientific Research in 1995.[1][2]

Foundational principles

Privacy by Design is based on 7 "foundational principles":[3]

  1. Proactive not reactive; Preventative not remedial
  2. Privacy as the default setting
  3. Privacy embedded into design
  4. Full functionality – positive-sum, not zero-sum
  5. End-to-end security – full lifecycle protection
  6. Visibility and transparency – keep it open
  7. Respect for user privacy – keep it user-centric

Global adoption

The seven foundational principles of Privacy by Design have been translated into over 30 languages.[4] In October 2010, regulators from around the world gathered at the annual assembly of International Data Protection and Privacy Commissioners in Jerusalem, Israel, and unanimously passed a resolution recognizing Privacy by Design as an essential component of fundamental privacy protection.[5]

This was followed by the U.S. Federal Trade Commission’s recognition of Privacy by Design in 2012 as one of its three recommended practices for protecting online privacy in its report entitled, Protecting Consumer Privacy in an Era of Rapid Change – a major validation of its significance.[6]

Data protection by Design has been incorporated into the European Commission plans to unify data protection within the European Union with a single law – the General Data Protection Regulation.[7] However, since the latest proposal does not define or give references for definitions of either data protection by design or privacy by design, it is not clear what is meant by the concepts. There are some initiatives that try to address this issue like the OWASP Top 10 Privacy Risks Project for web applications that gives hints on how to implement privacy by design in practice.

Criticism

Privacy by Design has been critiqued as "vague"[8] and leaving "many open questions about their application when engineering systems."[9] It has also been pointed out that Privacy by Design is similar to voluntary compliance schemes in industries impacting the environment, and thus lacks the teeth necessary to be effective, and may differ per company. In addition, the evolutionary approach currently taken to the development of the concept will come at the cost of privacy infringements because evolution implies also letting unfit phenotypes (privacy invading products) live until they are proven unfit.[8] Some critics have pointed out that certain business models are built around customer surveillance and data manipulation and therefore voluntary compliance is unlikely.[10]

Another criticism is that current definitions of privacy by design do not address the methodological aspect of system engineering, such as using decent system engineering methods, e.g., which cover the complete system and data life cycle. The concept also does not focus on the role of the actual data holder, but on that of the system designer. This role is not known in privacy law, so the concept of Privacy by Design is not based in law. This in turn undermines the trust by data subjects, data holders and policy makers.[8]

Since the concept is part of active research and policy development, biases may occur in the definitions used. An example is the tendency of North American legislation to let business themselves work out what this concept should mean (evolutionary approach) while EU tends to take a more regulatory approach, although this has not yet instantiated in this case.

Application areas

Much of the Privacy by Design research is directly related to one of nine key application areas:

  1. CCTV/surveillance cameras in mass transit systems[11][12]
  2. Biometrics used in casinos and gaming facilities[13][14]
  3. Smart meters and the smart grid[15][16][17]
  4. Mobile devices & communications[18]
  5. Near field communications (NFC) [19]
  6. RFIDs and sensor technologies[20][21][22]
  7. Redesigning IP geolocation data[23]
  8. Remote Home Health Care [24][25][26]
  9. Big data and data analytics [27]

See also

References

  1. ↑ Hes, R. "Privacy Enhancing Technologies: the path to anonymity".
  2. ↑ Hustinx, Peter. "Privacy by design: delivering the promises.".
  3. ↑ Cavoukian, Ann. "7 Foundational Principles".
  4. ↑ Cavoukian, Ann. "PbD in 33 Languages".
  5. ↑ "Resolution on Privacy by Design" (PDF). 32nd International Conference of Data Protection and Privacy Commissioners (October 2010).
  6. ↑ "Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Business and Policy-makers." (PDF). FTC Report (March 2012).
  7. ↑ "REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)". European Commissioner (January 2012).
  8. 1 2 3 van Rest, Jeroen. "Designing Privacy by Design".
  9. ↑ "Engineering Privacy by Design" (PDF). Seda Gurses, Carmela Troncoso, and Claudia Diaz.
  10. ↑ "Privacy by Design: A Counterfactual Analysis of Google and Facebook Privacy Incidents". Ira Rubinstein and Nathan Good.
  11. ↑ Cavoukian, Ann. "Privacy and Video Surveillance in Mass Transit Systems: A Special Investigation Report." (PDF).
  12. ↑ Cavoukian, Ann. "Guidelines for the Use of Video Surveillance Cameras in Public Places" (PDF).
  13. ↑ "Privacy-Protective Facial Recognition: Biometric Encryption Proof of Concept." (PDF). Ann Cavoukian, and Tom Marinelli.
  14. ↑ "Biometric Encryption: A Positive-Sum Technology that Achieves Strong Authentication, Security AND Privacy" (PDF). Ann Cavoukian, and Alex Stoivanov.
  15. ↑ "Applying Privacy by Design Best Practices to SDG&E’s Smart Pricing Program". Ann Cavoukian and Caroline Winn.
  16. ↑ "Privacy by Design: Achieving the Gold Standard in Data Protection for the Smart Grid" (PDF). Office of the Information and Privacy Commissioner of Ontario, Canada, Hydro One, and Toronto Hydro Corporation.
  17. ↑ "Building Privacy into Ontario’s Smart Meter Data Management System: A Control Framework" (PDF). Office of the Information and Privacy Commissioner Ontario, Canada, and Independent Electricity System Operator.
  18. ↑ "The Roadmap for Privacy by Design in Mobile Communications: A Practical Tool for Developers, Service Providers, and Users" (PDF). Ann Cavoukian, and Marilyn Prosch.
  19. ↑ Cavoukian, Ann. "Mobile Near Field Communications (NFC) "Tap 'n Go" – Keep it Secure and Private" (PDF).
  20. ↑ Cavoukian, Ann. "Adding an On/Off Device to Activate the RFID in Enhanced Driver’s Licences: Pioneering a Made-in-Ontario Transformative Technology that Delivers Both Privacy and Security" (PDF).
  21. ↑ "RFID and Privacy: Guidance for Health-Care Providers" (PDF). Office of the Information & Privacy Commissioner of Ontario, Canada, and Hewlett-Packard.
  22. ↑ Cavoukian, Ann. "Privacy Guidelines for RFID Information Systems (RFID Privacy Guidelines)" (PDF).
  23. ↑ "Redesigning IP Geolocation: Privacy by Design and Online Targeted Advertising" (PDF). Ann Cavoukian and Bering Media.
  24. ↑ "Sensors and In-Home Collection of Health Data: A Privacy by Design Approach" (PDF). Ann Cavoukian, Alex Mihailidis, and Jennifer Boger.
  25. ↑ "Remote Home Health Care Technologies: How to Ensure Privacy? Build It In: Privacy by Design" (PDF). Ann Cavoukian, David A. Hoffman, and Scott Killen.
  26. ↑ "Innovative Wireless Home Care Services: Protecting Privacy and Personal Health Information" (PDF). Office of the Information & Privacy Commissioner of Ontario, Canada, Research In Motion, Healthanywhere Inc. and MedShare.
  27. ↑ "Privacy by Design in the Age of Big Data" (PDF). Ann Cavoukian and Jeff Jonas.

http://hummedia.manchester.ac.uk/institutes/cmist/CAPRI/UK%20Privacy%20Cluster%20partner%20prospectus_Final.pdf

This article is issued from Wikipedia - version of the Wednesday, May 04, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.