Privacy & Compliance · Study deck

Privacy Patterns and Data Tiers

A meeting-room sensor counts entries locally and sends an hourly total.

Privacy Priya is your guide for this deck.

patterns

Privacy Priya, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: The second is the data tier: a way to sort the information a system handles by how sensitive it is, so the strength of a safeguard matches the risk of the data.
Explain: The European Chemical Society's scarcity-awareness table identifies about 30 elements commonly used in smartphones and notes that more than half may give cause for concern as scarcity increases.
Explain: A maintenance log of error codes is a low tier; a record linking a named user to their daily routine is a high tier and needs stronger protection.
Explain: Protection matches sensitivity.

Major section

Start With the Data You Really Need

Two ideas make privacy work repeatable instead of ad hoc.

The second is the data tier: a way to sort the information a system handles by how sensitive it is, so the strength of a safeguard matches the risk of the data.
For IoT, patterns and tiers fit together naturally.

Pattern choice should change the data path: raw sensing stays near the device, the edge derives only the aggregate needed for the feature, and the cloud receives summaries rather than identifiable streams.

Major section

Start With the Data You Really Need (continued)

A single product may handle operational telemetry, behavioral patterns, and directly identifying details all at once.

These strategies sit at one rung of a larger ladder that runs from the very abstract to the very concrete.
If you only need the intuition, this layer is enough: not all data is equally sensitive, and a few repeatable patterns cover most cases.
An analogy: a building does not protect every room with the same lock.

Major section

Start With the Data You Really Need (continued)

A storage closet, an office, and a vault get protection sized to what is inside.

Treating every piece of data identically either over-protects the harmless or under-protects the sensitive.
Three Moves That Repeat Minimize Collect and keep the least data the feature needs.
The cheapest data to protect is the data you never hold.
Separate, then tier Keep identity apart from behavior, and size every safeguard to the data's sensitivity tier.

Major section

Start With the Data You Really Need (continued)

Aggregate and localize Report group summaries instead of individual records, and process on the device when you can, so raw detail never leaves.

A doorbell that decides "motion or no motion" on the device uses local processing, so raw frames need never be uploaded.
A maintenance log of error codes is a low tier; a record linking a named user to their daily routine is a high tier and needs stronger protection.
If you can ask for the smallest useful data and see why sensitivity differs, you have the core idea.

Major section

Match Protection to Sensitivity · Check Whether the Pattern Actually Holds

A room count, a wearable trend, and a driver route should not all travel through the same privacy pipeline.

The workflow is two linked decisions.
Second, choose patterns that reduce exposure, and size the remaining safeguards to the tier.
Shareable for support and diagnostics with care.
Protection matches sensitivity.

Major section

Lifecycle Sustainability and Material Provenance Pattern

Privacy by design asks what information a product creates; responsible hardware design asks what material and labour trail the product requires.

Both use the same discipline: minimize what is not needed, separate risks that need different controls, retain provenance, and plan the end state before deployment.
Two calculations make short replacement cycles visible.

Mobile phones are opened and sorted by hand for recycling, showing separated housings, boards, keypads, and components at a responsible disassembly stage.

Major section

Lifecycle Sustainability and Material Provenance Pattern (continued)

The photograph does not certify the facility by itself; the lifecycle record below still needs take-back, data-erasure, worker-safety, and recovery-route evidence.

The European Chemical Society's scarcity-awareness table identifies about 30 elements commonly used in smartphones and notes that more than half may give cause for concern as scarcity increases.
Supply criticality changes with technology, geography, demand, recycling, and policy; conflict linkage, toxicity, and geological scarcity are separate axes.
Electronics teams should map high-risk supply chains toward smelters/refiners rather than treating a first-tier supplier declaration as proof.

Major section

Notice the Person Hidden in Two Occupancy Totals

The reduction fraction is 59 / 60 = 0.9833, rounded; it measures record count, not privacy risk.

The design still needs to consider what the remaining total reveals in context.
Each view may appear aggregated, but their overlap enables an inference about a much smaller group.

Major section

Notice the Person Hidden in Two Occupancy Totals (continued)

The smaller cloud representation is useful only if unnecessary raw inputs are actually discarded according to the stated policy.

A debug log that keeps the original stream creates another data path and another retention question.
Stable location and timing may still connect records across rotations.
The derived result may identify who was in the office, so evaluate it independently instead of inheriting the original count's lower tier.

Major section

Notice the Person Hidden in Two Occupancy Totals (continued)

A returned sensor can hold cached records, account bindings or credentials even when the cloud view looks empty.

Separate data erasure evidence from the photograph of hardware disassembly: the image shows recoverable assemblies, while a test must establish the state of the storage and account.
It explains why fewer records and larger groups are design choices whose conditions must still be checked against the service's actual uses.
Sending one hourly total reduces the number of transmitted count records from 60 to 1, a reduction of 59 divided by 60, or about 98.3%.

Major section

Summary · Key Takeaway

The team should not collect names just in case they become useful.

It should keep only the least data needed for the stated job.
A data tier groups records by how much harm their use or loss may cause.
Separate any reconnect key from the records it can unlock.
Removing a name does not always make data anonymous.

Deck summary

Key takeaways

Two ideas make privacy work repeatable instead of ad hoc.

A single product may handle operational telemetry, behavioral patterns, and directly identifying details all at once.
A storage closet, an office, and a vault get protection sized to what is inside.
Aggregate and localize Report group summaries instead of individual records, and process on the device when you can, so raw detail never leaves.
A room count, a wearable trend, and a driver route should not all travel through the same privacy pipeline.

Retrieval practice

Recall check 1 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q1A store wants to understand foot traffic by hour. Which approach best applies the aggregation pattern?

AReport the count of visitors per hour, without storing a separate record for each individual

BStore a timestamped identity record for every person who enters, then count them later

CRecord full video of the entrance and review it manually each day

DCollect everything now and decide what to aggregate later

Show answer

Answer: A Aggregation reports group summaries rather than individual records, delivering the insight with much less exposure.

Retrieval practice

Recall check 2 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q2A wearable needs to show a user their own weekly activity trend. The data is health-related. Which pattern-and-tier combination is most appropriate?

ATreat it as operational data and apply only basic access control

BTreat it as a sensitive tier: derive the weekly summary on the device.

CUpload continuous raw heart data to the cloud so the trend can be recomputed any time

DAggregate every user's heart data into one shared pool and show that to each person

Show answer

Answer: B Health data sits in the highest tier, so local processing, minimization, and strong protection are sized to the sensitivity.

Retrieval practice

Recall check 3 of 3

Privacy Priya says: answer from memory, then check your reasoning.

Q3A team publishes aggregated occupancy reports but lets users filter to very narrow groups, such as one room in a five-minute window. Why can this leak identity, and what is the fix?

AIt cannot leak identity, because the report is labeled as aggregated

BThe only fix is to rename the report so users do not expect privacy

CNarrow filters create groups so small they can single out one person.

DAdding more filter options would make the aggregation safer

Show answer

Answer: C Aggregation protects only when groups stay large enough to hide individuals.

Print reference

Answers

Answer key.

A · Aggregation reports group summaries rather than individual records, delivering the insight with much less exposure.
B · Health data sits in the highest tier, so local processing, minimization, and strong protection are sized to the sensitivity.
C · Aggregation protects only when groups stay large enough to hide individuals.