Privacy by Design References

-
(This was written and first published elsewhere in June 2020)

Below are some resources that have been useful as I've been exploring the relationship between privacy by design and engineering.
  • CNIL GDPR Guide for Developers
    • GDPR or not, this guide is a great stepwise process to keep an eye on privacy issues throughout the SDLC.
  • Putting the D into PbD: Turning Privacy Law into Design Solutions
    • This fun webinar during Privacy Awareness Week in May 2020 featured a role playing exercise to highlight the disconnect that lawyers and engineers often experience with respect to privacy engineering. Many of its lessons really resonated with experiences I've had. With an engineering hat on, answers seem like a simple binary solution. On the privacy side, however, it's one of the fuzzier areas of law. What to do?
    • Many of the examples in the webinar focused on clarifying shared language in context. For example, "sensitive data", "encrypted" or "personal information" are likely to have nuanced definitions across jurisdictions. Similarly, consent is not a magic wand to fix all of your potential legal or regulatory issues. (And might have a precise definition that only a lawyer could love.)
    • Another great idea reviewed was taking the classic (and still very useful) CIA security triad and expanding with a few privacy categories to ensure that privacy issues are included in risk assessments and threat models.
    • There are some great materials on the Salinger Privacy blog as well, check them out!
  • How to operationalize privacy by design
    • This IAPP article highlighted important communication considerations in implementing an organization-wide or product-specific privacy program. The importance of C-level support and early communication, getting involved in the right meetings early in projects, and trying to automate processes are among the recommendations here.
    • The need to constantly reevaluate your approach and integrate continuous learnings from various sources really resonated for me. Not only does guidance change -- hello, CCPA and maybe soon, CPRA -- but project needs rapidly shift. Whether checklists and guidance, code reviews, or advising on the privacy tradeoffs of new features, there's a lot for privacy pros to keep up with.

Popular posts from this blog

A Privacy Engineer's Guide to the EU AI Act

-
Image
I've been thinking about the ways the EU AI Act's requirements fit within existing privacy review or software development processes more generally. After the past few years of gradually improving data governance practices thanks to GDPR and other sources, tossing in a few more compliance requirements shouldn't be a big deal, right? Here are some answers and plenty of references for those who are just getting started. What is it? The EU AI Act is a risk-based framework for evaluating creation, use, and deployment of models. Some uses of AI are strictly prohibited, while requirements for others vary. Here's the raw text and a helpful AI Act Explorer .  Obligations are based primarily on whether you're a provider (of a general-purpose AI system) or deployer. (Definitions here .) It will be interesting to see where the line is drawn between provider and deployer; in other words, whether a deployer can modify a general purpose system enough to become a provider. Jurisdi...
Read more

Changing PDF Metadata with Python

-
While updating a pdf recently, I noticed some metadata I wanted to change and a few annotations that were hidden from view but still in the file. However, the "Get Info" pane in Preview on OS X doesn't provide a metadata editor, nor does its Export function, so it seemed like a good opportunity to learn a bit more about the PDF standard and Python packages for getting the job done. Adobe Acrobat or other GUI's would've been much faster, but I'll likely need to do this programmatically again at some point like those of you who might've found this post by looking on your favorite privacy-preserving search engine for "change pdf metadata in python". So here we go. Before starting, I hopped into a new folder and created a git repository with a first commit of my original pdf in case anything went wrong. Then I ran conda create --name pdf --python=3.8.1 and conda activate pdf to set up an Anaconda virtual Environment named pdf to keep my work is...
Read more