Building systems that protect people.
WHAT IT IS
Applying engineering practice to privacy requirements, rather than treating privacy as a policy document.
WHAT THE PRINCIPLES ARE
Collect the minimum necessary Use data only for the stated purpose Retain it only as long as needed Protect it appropriately Make behaviour transparent Give people control
WHAT DATA MINIMISATION ACHIEVES
Data not collected cannot be breached, misused or demanded.
WHAT PRIVACY BY DESIGN MEANS
Considering privacy from the outset, not retrofitting.
WHY RETROFITTING FAILS
Data models and collection decisions are expensive to reverse.
WHAT ANONYMISATION MEANS
Data that cannot be linked to an individual.
WHY IT IS HARDER THAN IT APPEARS
Combining attributes re-identifies people, and re-identification from supposedly anonymous datasets is well documented.
WHAT PSEUDONYMISATION MEANS
Replacing identifiers, with re-linking still possible.
WHAT THAT IS
A security measure, not anonymisation.
WHAT DIFFERENTIAL PRIVACY PROVIDES
A mathematical guarantee limiting what any individual's inclusion reveals.
WHAT IT COSTS
Accuracy, traded deliberately.
WHAT TO BUILD IN
Deletion that actually deletes, including from backups and derived data.
WHY
The right to erasure is meaningless otherwise.
