Privacy & Compliance · Study deck

Runtime Privacy Enforcement

The setting at the top of a privacy design must change the running path below it.

Privacy Priya is your guide for this deck.

privacy-by-designruntime-gatesprivacy-by-default
Privacy Priya, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • map the full data path a privacy switch must actually change
  • enforce a privacy setting with a runtime gate instead of a message-only control
  • default a control to the protective state and test that the default holds
  • Explain: A gateway is the device or service that carries local data toward another network.
iotclass.org

Major section

Start With the Switch That Must Change the Device

A gateway is the device or service that carries local data toward another network.

  • If nothing changes in the data path, the product has a privacy message rather than a privacy control.
  • Implementation is where that idea stops being a principle list and becomes system behavior.

Key terms

Privacy by default
Privacy by default means the protective state is the starting state: optional collection, external sharing, and long retention are off until someone chooses otherwise.
Privacy by Design
Privacy by Design is the idea that privacy is built into a system from the start, not bolted on after a complaint.
A privacy setting becomes real when its live state drives a runtime gate in the device-to-console data path; the seven-stage implementation trace ends in evidence and a regression test that fails if collection restarts.
A privacy setting becomes real when its live state drives a runtime gate in the device-to-console data path; the seven-stage implementation trace ends in evidence and a regression test that fails if collection restarts.
iotclass.org

Major section

Start With the Switch That Must Change the Device (continued)

Privacy by Design is the idea that privacy is built into a system from the start, not bolted on after a complaint.

  • The single most useful test of whether it is real is whether the setting changes what the system actually does in the path where data is collected, sent, stored, viewed, exported, or kept.
  • Evidence means you can show where each control is enforced and prove, with a test, that it still works.
  • If you only need the intuition, this layer is enough: trace a feature from purpose to data path to control to evidence.
iotclass.org

Major section

Start With the Switch That Must Change the Device (continued)

Settings must change behavior A toggle that updates the screen but not the data path is a failed control.

  • The evidence is a test that confirms the setting actually stops the data.
  • If you can explain why a setting must change behavior and why default-protective matters, you have the core idea.
  • Privacy by default means the protective state is the starting state: optional collection, external sharing, and long retention are off until someone chooses otherwise.
iotclass.org

Major section

Put the Privacy Gate in the Data Path

Once the promise is clear, build the control where the data actually moves.

  • Optional sensors and fields keep recording after opt-out.
  • Destination, purpose, and current setting all permit the send.
  • Records flow to analytics or partners regardless of choice.
  • Role, case reason, or a user-initiated support request exists.

Why it matters

Where to Place Runtime Gates A gate is a check that blocks an action unless the current setting and purpose allow it, and it logs the decision.

A runtime gate checks setting, purpose, and destination, then allows or denies the action and logs the decision; gates sit at the collect, move, access, and keep points.
A runtime gate checks setting, purpose, and destination, then allows or denies the action and logs the decision; gates sit at the collect, move, access, and keep points.
iotclass.org

Major section

Put the Privacy Gate in the Data Path (continued)

Worked Reasoning: Three Features, One Pattern Voice command device Responding to commands needs intent and device state, not stored history.

  • Old or disabled records linger indefinitely.
  • Minimize Early, Default Protective The strongest gate is the data you never create.
  • Activity wearable Trends need summaries, not continuous raw motion.
iotclass.org

Major section

Put the Privacy Gate in the Data Path (continued)

Pair this with a default matrix: optional data off at setup, local processing first, retention short by default, and external sharing off until a feature reason is recorded.

  • Derive steps and activity minutes on device, drop raw samples after the summary is checked, and inspect the sync payload to confirm it carries summaries only.
  • Shared-space occupancy Comfort automation needs room load, not named badges.
  • Control Surfaces and Release Evidence User and operator controls must connect to the gates, not just display text.
  • If you can run the workflow and place gates where data changes hands, you can stop here.
iotclass.org

Major section

Keep the Boundary Enforced After Launch

The deeper layer explains what makes each artifact genuinely protective rather than nominal.

  • The recurring failure is a control that looks present but is not enforced, separated, or tested, especially after new jobs, exports, destinations, or support tools are added.
  • Interface-only or cached check lets the action proceed.
  • The safe state is the starting state.

Key terms

Raw data
Raw data is dropped once a summary suffices.

Why it matters

Second, the denial should be observable: a logged "blocked send to destination X because setting off" is what lets a test prove the gate works.

A real pseudonymization boundary separates the identity store from events and gates the limited rejoin path with approval and logging; pseudonymous data is still personal data.
A real pseudonymization boundary separates the identity store from events and gates the limited rejoin path with approval and logging; pseudonymous data is still personal data.
iotclass.org

Major section

Keep the Boundary Enforced After Launch (continued)

Raw data is dropped once a summary suffices.

  • The contrast is a gate that is evaluated only in the interface, or evaluated once at startup and cached while the user later changes the setting.
  • Sync and store payloads contain summaries, not raw streams.
  • Raw records are synced "just in case" and retained.
iotclass.org

Major section

Keep the Boundary Enforced After Launch (continued)

Mapping shares a store every service can read.

  • If the token-to-identity mapping lives in the same database that every product service can read, the separation is cosmetic: any service can rejoin identity at will.
  • Setup-state and disabled-state tests at release.
  • Optional collection is on by default.
iotclass.org

Major section

Keep the Boundary Enforced After Launch (continued)

Tests That Can Actually Fail Release evidence is only meaningful if each test can fail when a future change breaks the behavior.

  • A new sensor, an added destination, a changed retention rule, an expanded support workflow, or a new integration can quietly reintroduce collection, sharing, retention, or access that the original review excluded.
  • Tests that fail on drift, with owner and retest trigger.
  • Second, the denial should be observable: a logged "blocked send to destination X because setting off" is what lets a test prove the gate works.
iotclass.org

Major section

Enforce a Door-Sensor Purpose at Runtime · Summary

A gateway is the device or service that carries local data toward another network, while a payload is the set of fields carried in one message.

  • In this privacy example, a door sensor in supported housing changes from CLOSED to OPEN at 02:14.
  • A collection gate asks whether this door field is needed.

Why it matters

If the policy service is unavailable, a narrowly defined emergency rule may allow the on-call alert, but that hardware and service behaviour must be tested in the deployed system.

A privacy setting becomes real when its live state drives a runtime gate in the device-to-console data path; the seven-stage implementation trace ends in evidence and a regression test that fails if collection restarts.
A privacy setting becomes real when its live state drives a runtime gate in the device-to-console data path; the seven-stage implementation trace ends in evidence and a regression test that fails if collection restarts.
iotclass.org

Deck summary

Key takeaways

A gateway is the device or service that carries local data toward another network.

  • Privacy by Design is the idea that privacy is built into a system from the start, not bolted on after a complaint.
  • Settings must change behavior A toggle that updates the screen but not the data path is a failed control.
  • Once the promise is clear, build the control where the data actually moves.
  • Worked Reasoning: Three Features, One Pattern Voice command device Responding to commands needs intent and device state, not stored history.
iotclass.org

Retrieval practice

Recall check 1 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q1An IoT app lets users turn off optional analytics in settings, but the device still sends analytics events to the service. What implementation issue does this reveal?

ANothing is wrong, because the user saw a setting in the interface
BIt is only a documentation problem
CThe setting is not enforced by a runtime privacy gate.
DThe device should collect more analytics by default to compensate
Show answer

Answer: C A privacy setting must change the real data path.

iotclass.org

Retrieval practice

Recall check 2 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q2A wearable can show daily activity trends from on-device summaries, but the proposed sync sends continuous raw motion records. What is the best implementation change?

ASync the raw motion records because they might support a future feature
BKeep the raw sync but hide it from the dashboard
CDisable all activity features to be safe
DCompute the summaries locally and sync only the summary records the feature needs.
Show answer

Answer: D A minimization pipeline derives the needed output early and drops raw input, keeping the feature while shrinking the synced data path.

iotclass.org

Retrieval practice

Recall check 3 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q3A team pseudonymizes event records by replacing user IDs with tokens, but stores the token-to-identity mapping in the same database that every product service can read. Why is this not an effective pseudonymization boundary, and what is the fix?

AAny service can rejoin identity at will, so the separation is only nominal.
BIt is fully effective, because the direct user IDs were replaced with tokens
CThe only fix needed is to encrypt the token column in place
DTokenizing the IDs makes the data anonymous, so no boundary is required
Show answer

Answer: A A boundary requires that the reconnect information be genuinely separated and its use controlled.

iotclass.org

Print reference

Answers

Answer key.

  1. C · A privacy setting must change the real data path.
  2. D · A minimization pipeline derives the needed output early and drops raw input, keeping the feature while shrinking the synced data path.
  3. A · A boundary requires that the reconnect information be genuinely separated and its use controlled.
iotclass.org