Start safeguarding personal information of your users at the earliest beginning in a project and make it default. In this talk I will go over the concepts of privacy by design and default where I will go deeper into the why and how of safeguarding your user's personal information.

1. GDPR
PRIVACY BY DESIGN & DEFAULT
GDPR article 25

2. MICHELANGELO VAN DAM
Doing stuff on the internet…

3. GDPR
WHAT WAS GDPR AGAIN?
Regulate the privacy of EU data subjects
Sanction organisations in violation of GDPR
Offer a privacy framework for businesses

4. GDPR
GDPR FRAMEWORK
Article 25: Privacy by design and default

5. GDPR
PRIVACY BY DESIGN
Request the minimum of personal information
Secure personal information
Get rid of personal information quickly

6. GDPR
PRIVACY BY DEFAULT
Don’t ask what you do not need
Anonymity is the default
Gain trust by protecting privacy

7. #PrivacyTip:
Non-identi
fi
able personal
information is like toxic waste: it
burns your skin,
Identi
fi
able personal information
is nuclear waste: stay away
from it!

8. WHAT IS AT STAKE?
No one can predict the future

9. PROTECTION CORE
Individual
Finance
Health
Religion
Politics
Education
Sex
Identity
Relationship

10. DEMOCRATIC
SOCIETY
Human liberties, rights and freedom
can change overnight

11. DIGITAL THEFT
Hackers, Ransomware gangs, State
Sponsored Cyber groups, …

12. INSIDER THREAT
The people within an organisation are the
weakest link
67%
of data breaches are caused by insiders

13. EVERYONE IS A TARGET
Not a matter of “if”, but “when”

14. 2018

15. DID WE IMPROVE?

16. PRIVACY DESIGN PATTERS

17. DEFAULT OFF, GRANULAR ON
When using a feature that has a potential of collecting
personal information, start with it in the “off” state and let
users turn it on if they want to make use of this feature.

18. STRIP INVISIBLE METADATA
Provide a functionality that removes invisible metadata from
an item that has been provided on your platform (e.g. EXIF
data in photos, document history, IP addresses).

19. PERSONAL DATA CONFINEMENT
When collecting personal information, ensure that business
and personal data are kept separate (e.g. on device), without
the ability to link both data sources.

20. PERSONAL DATA STORE
When using personal devices (e.g. mobile device, personal
computer), you can use on-device storage for setting
personalised con
fi
gurations and preferences.

21. PRIVACY DASHBOARD
Provide a self-serviced, privacy dashboard where users can
request access to their personal information for review,
modify, remove, and transfer their data.

22. PRIVACY KILLSWITCH
Provide a mechanism that would remove, disconnect or
anonymise all personal information at the press of a single
button.

23. MORE PRIVACY PATTERNS
More at https://privacypatterns.org

24. IT’S THE LAW

25. INTERNATIONAL ADOPTION
Australia
India
US (California)
Canada
Argentina
Uruguay
New Zealand
South Africa

26. INTERNATIONAL ADOPTION
More countries are taking actions

27. IT’S UP TO THE DEVELOPERS!
Learn about (web application) security
Learn about encryption types & techniques
Add more telemetry in your applications

28. GREENFIELD PROJECT
User information
Location data
Advertisements

29. BROWNFIELD PROJECT
Customer data
Financial records
Employee info

30. THINGS DEVS CAN DO
Ask bare minimum
Reduce retention time
Remove from UI
Apply ACL/RBAC
Add DLP* solutions
Anonymise data
Encrypt data
Point out violations
(*) DLP: Data Leak Prevention

31. LEAD BY EXAMPLE
Things you can do for better privacy

32. CHALLENGE THE INFORMATION
Ask: what, why, how, and how long

33. ENCRYPT THE INFORMATION
If you keep information, make sure it is securely stored

34. EXPIRE THE INFORMATION
Don’t keep personal information any longer than needed

35. MONITOR THE INFORMATION
Know who has access to personal information and for what purpose

36. #InterestingFeat:
Did you know that
keeping a social security
number costs € 250.000
each day to protect?

37. SUMMARY
GDPR is here to stay
Personal information protection goes global
We all have a responsibility to protect data

38. REFERENCES
Privacy Design Patterns Eight Privacy Design Patterns
ENISA Privacy By Design
Article 25 GDPR ICO Data protection
Data protection in the EU

39. QUESTIONS?
Slides online
slideshare.net/DragonBe
Contact me
twitter.com/DragonBe