Presentation given on the experience of privacy design labs on the LSEC Belgium GDPR event of 30 November 2017. Event page: https://www.leadersinsecurity.org/events-old/icalrepeat.detail/2017/11/30/186/-/gdpr-plan-to-be-ready-prepare-to-set-change-to-go-session-3-privacy-impact-assessment-scenario-planning-data-loss-management.html?filter_reset=1 Privacy Design lab page: https://sites.google.com/site/pbd20171106 Example of a privacy design jam by Facebook (Berlin 2017) : https://www.facebook.com/facebookbrussels/videos/1419793831400471/

1. Privacy (by) Design
GDPR event - 30 Nov 2017
Tommy Vandepitte

2. http://www.legaltechdesign.com/LegalDesignToolbox/

3. Case 1

4. Participant

5. Case 2

6. Co-organiser

7. Master of ceremony
Arthur Christmas

8. Timekeeper
Arthur Christmas

9. Experts
Arthur Christmas

10. Helpers
Arthur Christmas

11. https://sites.google.com/site/pbd20171106

12. Questions / Go on
Take your pick

13. What’s in it for you? (externally)
Qualifier

14. What’s in it for you? (externally)
Differentiator

15. What’s in it for you? (externally)

16. What’s in it for you? (externally)
• Decision makers
• Future users
• CIOs
• CISOs
• DPOs
• Legal
• …

17. What’s in it for you? (externally)
 Our agreeent is in line with (article 28)
GPDR
 Our product helps you comply with
GDPR…
 We thought about the principles, give a
baseline, but you can tweak
 We thought about data subject rights, and
have implemented like this
 We have a dashboard for the end
customers preference, and it works like this
 We have audit logs, a compliance role, …
 … and I have the documentation to
back it up

18. What’s in it for you? (internally)
� Bring people together
� Better understanding of each others’ position
� Creates awareness
� People unknowingly learn
� Tackle big problems early, small problems later…
� Overall less rework (and thus lower cost)

19. Challenges
� It is a time investment
� First, you have to speak the same language
� DPO must stand strong in his/her shoes
� DPO must be honest
� DPO must be willing to invest in understanding the
business
� DPO needs to learn to give advice in uncertainty
� Business needs to learn that first advice may need
to be adjusted due to incremental insight
�…

20. The Justice League
https://www.youtube.com/watch?v=ZJVvrmLSTsg
Quis custodiet ipsos custodes?

21. Sidedeck

22. Think it through

24. International

25. Legal perspective

26. Legal perspective

27. In fact… it is a tale of old

28. Take different perspectives

29. Data subject centric
in mind around the table

30. Bring the bunch together

31. A challenge

32. Analysis

33. Start with why?

34. Look at the general UI

35. Overcome the human nature

36. Think like an “attacker”
…but also

37. Multiple iterations

38. Lean

39. No (full) checklist ?
 “Ethics cannot be captured in
checklists.”
 Legislation is vague (on purpose).
 Parties are not “out” on the matter
yet.
 No checklist can ever be “exhaustive”.

40. Academic frameworks

41. Academic frameworks

43. Academic frameworks

44. Where the rubber hits the road

45. Open innovation

46. Co-creation
Vodafone / Thomson Reuters

50. https://www.ted.com/talks/seth_godin_this_is_broken_1

51. Game design
Marlous Theunissen