Privacy by Design References

(This was written and first published elsewhere in June 2020)

Below are some resources that have been useful as I've been exploring the relationship between privacy by design and engineering.
  • CNIL GDPR Guide for Developers
    • GDPR or not, this guide is a great stepwise process to keep an eye on privacy issues throughout the SDLC.
  • Putting the D into PbD: Turning Privacy Law into Design Solutions
    • This fun webinar during Privacy Awareness Week in May 2020 featured a role playing exercise to highlight the disconnect that lawyers and engineers often experience with respect to privacy engineering. Many of its lessons really resonated with experiences I've had. With an engineering hat on, answers seem like a simple binary solution. On the privacy side, however, it's one of the fuzzier areas of law. What to do?
    • Many of the examples in the webinar focused on clarifying shared language in context. For example, "sensitive data", "encrypted" or "personal information" are likely to have nuanced definitions across jurisdictions. Similarly, consent is not a magic wand to fix all of your potential legal or regulatory issues. (And might have a precise definition that only a lawyer could love.)
    • Another great idea reviewed was taking the classic (and still very useful) CIA security triad and expanding with a few privacy categories to ensure that privacy issues are included in risk assessments and threat models.
    • There are some great materials on the Salinger Privacy blog as well, check them out!
  • How to operationalize privacy by design
    • This IAPP article highlighted important communication considerations in implementing an organization-wide or product-specific privacy program. The importance of C-level support and early communication, getting involved in the right meetings early in projects, and trying to automate processes are among the recommendations here.
    • The need to constantly reevaluate your approach and integrate continuous learnings from various sources really resonated for me. Not only does guidance change -- hello, CCPA and maybe soon, CPRA -- but project needs rapidly shift. Whether checklists and guidance, code reviews, or advising on the privacy tradeoffs of new features, there's a lot for privacy pros to keep up with.

Popular posts from this blog

A Privacy Engineer's Guide to the EU AI Act

A New Serverless Look