Privacy by Design Flashcards
PbD is an approach that anticipates privacy issues and seeks to prevent problems before they arise.
In this approach, designers must assess the potential vulnerabilities in a system and the types of threats that may occur and then select technical and managerial controls to protect the system
Proactive, not reactive; preventive, not remedial
This principle requires an organization to ensure that it only processes the data that is necessary to achieve its specific purpose and that PII is protected during collection, storage, use, and transmission
Privacy as the default
Privacy protections should be core, organic functions, not added on after a design is complete.
Privacy should be integral both to the design and architecture of IT systems and to business practices
Privacy embedded into the design
Designers should seek solutions that avoid requiring a trade-off between privacy and system functionality or privacy and security
Full functionality: positive-sum, not zero-sum
This principle encompasses two concepts. Refer to the protection from time of collection through retention and destruction.
During this life cycle, there should be no gaps in the protection of the data or accountability for the data. The term security highlights that security processes and controls are used to provide not just security but privacy
End-to-end security-life cycle protection
PbD seeks to assure users and other stakeholders that privacy-related business practices and technical controls are operating according to state commitments and objectives
Visibility and transparency
The organization must view privacy and primarily being chracterized by personal control and free choice.
Respect for user privacy
