Understanding Privacy by Design and by Default
Management commitment is crucial for deciding to apply the principles of use data protection by design in the organisation’s procurements and software development. Management must also ensure to provide sufficient resources for this task. Taking data protection into account throughout the development process is both cost-effective and more efficient than making changes to an existing piece of software. Enterprises that do not comply with the GDPR risk significant costs, in the form of both fines for breaking the law, liability to the data subjects, and loss of revenue resulting from damage to their reputations.
Data protection by design and data protection by default are central requirements in the General Data Protection Regulation (GDPR) that apply from May 2018. The data controller must comply with the requirements governing data protection by design during software development, and when ordering systems, solutions, and services. The provisions must accordingly also be included when entering into agreements with suppliers, and when using consultants.
IT developers, software architects, data protection officers ('DPOs'), project managers, testers, and security advisors they all need to understanding Privacy by Design and by Default. The primary components are seven critical activities in the production cycle, namely training, requirements for data protection and information security, design, coding, testing, release and maintenance, and provides recommendations on how to carry them out.
About requirements, the Guide recommends involvement of the DPO and the security advisor and compliance with the data protection principles, as well as suggests providing concise information and securing the data, defining risk tolerance levels and carrying out appropriate Security Risk Assessments and Data Protection Impact Assessments.
What is data protection by design?
Profiling, automated decision-making, and personalised services have become part of our day-to-day lives. These trends often involve processing of personal data on a large scale. Users expect services to both be secure and effectively safeguard their privacy. Businesses that take data protection issues seriously build trust. Thus, substantial data protection measures can be a competitive advantage.
Data protection legislation contains basic principles for safeguarding the privacy of data subjects. Data protection by design and by default helps ensure that the information systems we use to fulfil these data protection principles and that the policies and systems safeguard the rights of data subjects.
Transparency is a principle in the new regulation, and it is crucial when building data protection into the software. Transparency about the use of personal data involves providing information about what is being processed, by whom, why, how, and for how long it is kept. For data subjects to exercise their rights, organisations must be open about their processing of personal data. That way, the data subjects can make informed decisions about whether or not to use software, and this ensures the legitimacy and effectiveness of the data controller.
For more information see https://www.datatilsynet.no/en/regulations-and-tools/guidelines/data-protection-by-design-and-by-default/?id=7728
