What is Privacy by Design?

Thinking about data protection from the very beginning

Privacy by Design is the data protection compliant technical design and development of IT systems. The GDPR regulates this principle in Article 25 and the Recital 78. It makes sense to examine possible data protection problems already in the development phase and to Data protection to be included in the conception from the outset, instead of having to solve these problems afterwards in a tedious and time-consuming way. The Privacy by Design approach includes, among other things, the requirement of data economy, the separation of personal identifiers and content data, the use of the pseudonymisation and the anonymisation and the timely deletion of personal data.

What is the difference between Privacy by Design and Privacy by Default?

The three most important principles of Privacy by Design are firstly, transparency of data processing and the possibility of control by the data subject, secondly, the use of procedures that meet technical security standards, and thirdly, privacy by default. This serves to protect the users, especially if users have limited IT knowledge and are therefore not in a position to take the necessary technical measures themselves.

An implementation example of Privacy by Default is the tracking settings of browsers. The browser automatically informs the visited websites that the user does not want or is not allowed to be tracked. The user can also switch off this protection and agree to tracking. This is called opt-in.

Consequences for data protection

The Privacy by Design approach should be as binding on technology manufacturers and developers as it is on those who are responsible for data processing and decide on the procurement and use of IT systems.

Apps, for example, should be designed in such a way that, by default, they process only those data that are necessary for basic functionality. Other functions that require further data of the person concerned must first be activated by the user. Prior to this, the user must be informed in a few sentences about the benefits, the recipients authorised to access the data and the storage period of the data.

The data subject should always be in control of his or her data and should be able to check which app function requires which data for which purpose and should be able to activate or deactivate individual functions. Observance of Privacy by Design also leads to an analysis of the future susceptibility of technologies to misuse. Therefore, the validity period of certificates should not be too long. Systems must be designed in such a way that security measures can be improved and added at a later date.