7.1 The Company shall conduct its operations at all times with a Privacy by Design objective as set forth in ‘The General Data Protection Regulation (EU) 2016/679’, Article 25:
Privacy by Design (hereinafter, PbD) involves a focus geared towards risk management and accountability to establish strategies that incorporate privacy protection throughout the life cycle of an object (whether it is a system, a hardware or software product, a service or a process). By an object’s life cycle, we take to mean all the stages that it goes through, from its concept development until its removal, passing through the stages of development, production, operation, maintenance and withdrawal. Furthermore, it involves taking into account not only the application of measures for privacy protection in the early stages of the project, but also to consider all the business processes and practices that process associated data, thus achieving a true governance of personal data management.
In order to fulfill this objective seven core principles as established by developed by Anne Cavoukian, Ontario’s Data Protection Commissioner must be met at all times:
7.1.1 Privacy must be proactive not reactive; Preventative not remedial
PbD involves anticipating events that affect privacy before they take place. Any system, process or infrastructure that uses personal data must be conceived and designed from the beginning by identifying possible risks to the rights and freedoms of the data subjects and minimising them before they can cause actual damage. PbD policy is characterised by the adoption of proactive measures that anticipate threats, identify weaknesses in systems to neutralise or minimise risks instead of applying remedial measures to resolve security incidents once they have taken place. That is to say, PbD avoids “the policy of rectification” and anticipates the materialisation of risk. This involves:
● A clear commitment by The Company which must be promoted from the highest levels of the Administration.
● Developing a culture of commitment and continued improvement by all workers, as a policy means nothing until and unless it is translated into concrete actions that are fuelled by results.
● Defining and assigning concrete responsibilities so that each member of The Company is clearly aware of their tasks with regard to privacy.
● Developing systematic methods based on indicators for the early detection of processes and practices that are deficient in guaranteeing privacy.
7.1.2 Privacy must be the default setting
PbD seeks to provide the user with the highest levels of privacy possible given the state of the art, and especially, that personal data are automatically protected in any system, application, product or service. The default setting must be established by design to be set to the level that provides the maximum possible privacy. If the subject does not modify the setting, their privacy is guaranteed and must remain intact, as it is integrated into the system and constitutes the default setting.
This principle, in practical terms, is based on data minimisation throughout the stages of processing: compilation, use, retention and distribution. For this it is necessary to:
● Make data collection criteria as restricted as possible.
● Limit the use of personal data to the goals for which they were collected and ensure that there is a legitimate basis for processing.
● Restrict access to personal data to the parties involved in the processing in accordance with the “need to know” principle and according to the function behind the creation of differentiated access profiles.
● Define strict time limits for retention and to establish operational mechanisms that guarantee compliance.
● To create technological and procedural barriers to the unauthorised linking of independent sources of data.
7.1.3 Privacy must be embedded into the design
Privacy must be an integral and inseparable part of the systems, applications, products and services, as well as the business practices and processes of an organisation. It is not an additional layer or module that is added to a pre-existing entity, rather it must be integrated into the group of non-functional requirements from the stages of concept development and design themselves. To guarantee that privacy is accounted for in the early design stages, we must:
● Consider it as an essential requirement within the life cycle of systems and services, as well as in the design of organisational processes.
● Perform a risk analysis of the rights and freedoms of persons and when applicable, perform data protection impact assessments, as an integral part of any new processing initiative.
● Document all decisions that are adopted within The Company from a “privacy design thinking” perspective.
7.1.4 Privacy integrations must offer full functionality
It has traditionally been understood as privacy gained at the cost of other functionalities, thus presenting dichotomies such as privacy vs. usability, privacy vs. functionality, privacy vs. business benefit, and even privacy vs. security. This is a contrived approach and the goal must be to seek an optimal balance for a “win-win” search, with an open mind that accepts new solutions for fully functional, effective and efficient solutions both at business and privacy levels. For this, from the first stages of concept development of products and services, an organisation must:
● Assume that different and legitimate interests may coexist: those of The Company and those of the users to whom it provides services, and that it is necessary to identify, assess and balance them accordingly.
● Establish channels of communication for collaboration and consultation for the participants in order to comprehend and bring together multiple interests that, at first glance, may seem to diverge.
● If the proposed solutions threaten privacy, seek new solutions and alternatives to achieve the intended functionality and purposes, but never losing sight of the fact that risks to the user’s privacy must be adequately managed.
7.1.5 Systems must offer end-to-end security, and full lifecycle protection:
Privacy is born in design, before the system is set in motion, and it must be guaranteed throughout the life cycle of the data. Information security involves the confidentiality, integrity, availability and resilience of the systems that store it. Privacy also guarantees unlink ability, transparency and the data subject’s capacity for intervention and control in the processing (intervenability). To integrate privacy throughout the stages of data processing, the different operations involved (collection, recording, classification, conservation, consultation, distribution, limitation, erasure, etc.) must be thoroughly analysed and in each case, the most adequate measures for information protection must be implemented, among which are:
● Early pseudonymisation or anonymisation techniques.
● Classification and organisation of data and processing operations based on access profiles.
● Default encryption so that the “natural” state of data when stolen or robbed is “illegible”.
● The safe and guaranteed destruction of the information at the end of its life cycle.
7.1.6 Privacy standards must offer visibility and transparency
One of the keys to guaranteeing privacy is to be able to demonstrate it, verifying that the processing is in accordance with the given information. Transparency in data processing is essential for demonstrating diligence and accountability before the Supervisory Authority and as a measure of trust before data subjects. As established in Article 39 of the GDPR, it should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. Promoting transparency and visibility requires the adoption of a series of measures such as:
● Making the privacy and data protection policies that govern the functioning of The Company public
● Developing and publishing concise, clear and comprehensible information clauses that are easily accessible and allow data subjects to understand the scope of the processing of their data, the risks that they may be exposed to, as well as how to exercise their rights regarding data protection.
● Although it is not compulsory for all controllers, making public or at least easily accessible for data subjects, the list of all the processing carried out in The Company.
● Sharing the identity and contact details of The Company’s data controller
● Establishing accessible, simple and effective mechanisms of communication, compensation and complaints for the owners of the data.
7.1.7 Systems must prioritize user privacy
Without forgetting the legitimate interests of The Company with regard to the data processing it performs, the ultimate goal must be to guarantee the rights and freedoms of the users whose data is processed, and therefore, any adopted measure must focus towards guaranteeing their privacy. This involves designing “user-centric” processes, applications, products and services, anticipating their needs. The user must play an active role in managing their data and in controlling what others do with it. Their inaction must not imply reduced privacy, referring back to one of the aforementioned principles which advocates a default privacy setting that offers the highest level of protection. Designing processes, applications, products and services that are focused on guaranteeing the privacy of data subjects involves:
● Implementing privacy settings that are “robust” by default and where users are informed of the consequences to their privacy when established parameters are modified.
● Making available complete and suitable information that leads to an informed, free, specific and unambiguous consent that must be explicit in all cases that require it.
● Providing data subjects access to their data and to detailed information on the processing goals and communications carried out.
● Implementing efficient and effective mechanisms that allow data subjects to exercise their rights on data protection.