Privacy by Design vs Privacy by Engineering (rvn.grcia)

​Privacy by Design (PbD) vs. Privacy by Engineering (PbE)

By Rvn Grcia

Privacy by Design (PbD)

This concept, pioneered by Dr. Ann Cavoukian, is a proactive approach. It's about building privacy into the very foundation of a system or process, not just adding it on as an afterthought. It's a "win-win" approach that shows you can have strong privacy without sacrificing functionality.

7 Foundation Principles of
Privacy by Design

Proactive, not Reactive;
Preventative, not Remedial

This means you anticipate and prevent privacy risks before they even happen, rather than waiting for a data breach to occur and then trying to fix it.

Privacy as the Default Setting

The system's default settings should automatically protect a user's privacy. If a user does nothing, their privacy is still maintained.

Privacy Embedded into Design

Privacy is an integral component of the system's architecture and design, not an optional "add-on" feature.

Full Functionality — Positive-Sum, not Zero-Sum

This principle rejects the idea that you have to give up functionality to gain privacy. It seeks to accommodate all legitimate interests in a "win-win" manner.

End-to-End Security — Full Lifecycle Protection:

Security is essential for privacy. This means the data is protected securely throughout its entire lifecycle—from collection to use, and finally, to secure deletion.

Visibility and Transparency — Keep it Open:

All stakeholders should be assured that the system operates according to its stated promises. The business practices and technology used should be visible and transparent to all users.

Respect for User Privacy — Keep it User-Centric

The user's interests are paramount. This involves providing strong privacy defaults, clear notices, and user-friendly options for managing their own data.

5 Components of
Privacy by Engineering

Privacy by Engineering (PbE)

This is the technical discipline that turns the abstract principles of PbD into reality. It's the practical work of building and implementing tools, methods, and techniques to ensure that systems are truly privacy-preserving.

Multiple Choice

Privacy by Engineering means

• Implementation of privacy - preserving

• Implementation of security - preserving

Multiple Choice

Identifying and evaluating potential privacy threats and vulnerabilities.

• Compliance Management

• Risk Assessment

Multiple Choice

Collecting, using, and retaining only the personal data that is absolutely necessary for a specific purpose.

• Data Governance

• Data Minimization

Multiple Choice

Using technologies that protect personal data, often by reducing or eliminating its use.

• Privacy-Enhancing Technologies (PETs)

• Compliance Management

Multiple Choice

Creating and enforcing policies for how data is handled.

• Compliance Management

• Data Governance

Multiple Choice

Ensuring that the system adheres to privacy laws and regulations (like GDPR or CCPA) through technical controls.

• Compliance Management

• Data Minimization

​In short, PbD gives you the "why" and the "what"—the principles to follow. PbE provides the "how"—the practical, engineering-based methods to actually implement those principles in a real-world system.