Privacy & Compliance · Study deck
Seven Foundational Privacy Principles
Before treating the seven principles as a checklist, use @fig-pbd-foundations-principles to see them as constraints around one product design.
Privacy Priya is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- apply the seven Privacy by Design principles from the first design sketch, not after launch
- turn a Privacy by Design principle into a specific feature decision
- make each principle enforceable rather than aspirational
- Explain: The team can still choose whether motion is processed on the device, whether clips are saved by default, whether visitors are identified, and whether the owner can delete records later.
Major section
Start Before the Sensor Turns On
The team can still choose whether motion is processed on the device, whether clips are saved by default, whether visitors are identified, and whether the owner can delete records later.
- Privacy by Design is the idea that privacy protection is built into a system from the first sketch, not added after a complaint.
Major section
Start Before the Sensor Turns On (continued)
A camera, a microphone, a location radio, or a presence sensor can capture far more than a feature needs.
- The approach was articulated as a set of foundational principles by Ann Cavoukian, then Information and Privacy Commissioner of Ontario, and it has since become a common reference point for engineers, designers, and regulators.
- People opt in to more, they do not have to opt out of surprises.
- Embedded controls beat written promises.
Major section
Turn Principles Into Feature Decisions
We will deal with complaints if they come.
- A team wants a device alert, a cloud sync, an app dashboard, or a support tool.
- The principles become useful when you run them against a specific feature, one at a time.
- Optional collection, sharing, and long retention are off at setup.
- Plain, specific disclosure that matches actual behavior.
Major section
Turn Principles Into Feature Decisions (continued)
The point is not to score the feature; it is to make a deliberate, written decision about data instead of an accidental one.
- Everything is on so the feature looks complete.
- A check in the code path that runs whenever data is handled.
- A toggle that only changes the screen, not the behavior.
Major section
Turn Principles Into Feature Decisions (continued)
A settings page that displays text but stops nothing.
- A delivery sensor needs to confirm a package arrived, not record a continuous video of the porch.
- Three Devices, One Method Occupancy automation Need: is the room in use.
- Decision: derive a presence state on the device, default history off, and disclose that no identity is stored.
Major section
Turn Principles Into Feature Decisions (continued)
Positive-sum because comfort still works.
- Lifecycle protection includes the cloud copy.
- Decision: default transcript storage off, embed the check in the storage path, and make the on or off state visible and honest.
- If you can run the seven questions against a feature and find the positive-sum design, you can stop here.
Major section
Make Each Principle Enforceable
The final step is to turn the story into something a reviewer can test.
- The principle must change the pipeline, the stored data, the defaults, or the user's control.
- The deeper layer explains why a list of principles is not yet protection.
- Foundations, Assessment, and Implementation Are Different Jobs Precise teams keep three activities distinct.
Major section
Make Each Principle Enforceable (continued)
Default Protective Means the Pipeline, Not the Screen Privacy as the default is the most misread principle.
- Each principle names a property the system should have, but a property only exists when a mechanism guarantees it and evidence shows it still holds.
- Foundations are the principles and the stance they imply.
- Mechanism That Makes It Real.
Major section
Make Each Principle Enforceable (continued)
The contrast is a control evaluated only in the app, or evaluated once at startup and cached while the user later changes the setting.
- The recurring failure is principle theater: a design that recites the seven principles while none of them changes behavior.
- Setup-state and disabled-state tests.
- Disclosure that matches measured behavior.
Major section
Make Each Principle Enforceable (continued)
A device whose interface shows analytics as off, while the firmware still sends analytics events, has a protective screen and an unprotected pipeline.
- Embed the Check Where Data Moves Embedding privacy means the protection sits in the data path and survives changes to the interface.
- Lifecycle Security Includes the Copies End-to-end protection across the lifecycle is where many designs stop too early.
- Interface-only or cached check that data can bypass.
Major section
Make Each Principle Enforceable (continued)
Data is often well protected in transit and then forgotten in places that outlive the feature: log files, analytics stores, caches, backups, and support exports.
- Implementation is the act of turning a principle into an enforced control with a test.
- Assessment is the separate practice of examining a design or system, often through a privacy impact assessment, to find weak or missing controls.
- Stored and synced payloads carry summaries, not raw streams.
Major section
Make Each Principle Enforceable (continued)
Reciting foundations is not implementation, and implementing is not the same as assessing whether the result is adequate.
- A map of stores, logs, and backups with a deletion path.
- A notice checked against what the system actually does.
- A policy that describes a system that has changed.
Major section
Make Each Principle Enforceable (continued)
At this depth, Privacy by Design foundations are a set of properties that only count when a mechanism guarantees each one and evidence shows it holds.
- Default in the pipeline, embed on every path, protect every copy, minimize before you store, and keep disclosure honest.
- A trustworthy review asks not whether the seven principles are named, but where each one is enforced and what test would catch it breaking.
- The default must be enforced where data flows, so that the off state stops the data, not just the chart.
Deck summary
Key takeaways
The team can still choose whether motion is processed on the device, whether clips are saved by default, whether visitors are identified, and whether the owner can delete records later.
- A camera, a microphone, a location radio, or a presence sensor can capture far more than a feature needs.
- We will deal with complaints if they come.
- The point is not to score the feature; it is to make a deliberate, written decision about data instead of an accidental one.
- A settings page that displays text but stops nothing.
Retrieval practice
Recall check 1 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q1Which change best reflects Privacy by Design rather than a privacy afterthought?
Show answer
Answer: A Choosing not to collect or keep unnecessary data is a design-time decision that builds privacy into the system.
Retrieval practice
Recall check 2 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q2A team says a useful occupancy feature requires storing identified camera footage, framing it as privacy versus functionality. What does the positive-sum principle suggest?
Show answer
Answer: A Positive-sum rejects the false trade-off: ask what result the feature truly needs, then find the smallest data that delivers it while reducing exposure.
Retrieval practice
Recall check 3 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q3A device shows optional telemetry as off by default in its app, yet the firmware still transmits the telemetry. Why does this fail privacy as the default, and what is the fix?
Show answer
Answer: B Privacy as the default requires the protective starting state to constrain real behavior.
Print reference
Answers
Answer key.
- A · Choosing not to collect or keep unnecessary data is a design-time decision that builds privacy into the system.
- A · Positive-sum rejects the false trade-off: ask what result the feature truly needs, then find the smallest data that delivers it while reducing exposure.
- B · Privacy as the default requires the protective starting state to constrain real behavior.