Privacy & Compliance · Study deck
Privacy Architecture Schemes
Picture a baby monitor that can detect crying inside the room.
Privacy Priya is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- choose an overall architecture scheme (local-first, privacy zones, personal data store) instead of one clever feature
- decide where in the architecture a raw signal should be reduced before it leaves the device
- combine patterns and data tiers into a system-level privacy architecture with release evidence
- Explain: The privacy decision begins with where those answers are produced and whether the raw stream ever has to leave the device.
Major section
Start With Where the Data Lives
The privacy decision begins with where those answers are produced and whether the raw stream ever has to leave the device.
- A privacy scheme is the overall architecture shape of a system.
- Once you decide that raw video never leaves the camera, a long list of downstream risks simply cannot happen.
Major section
Start With Where the Data Lives (continued)
A single technique, like a load-bearing wall, is a pattern.
- A scheme arranges many such patterns into a coherent whole that decides what stays on the device, what crosses to a hub, and what ever reaches the cloud.
- Once you decide that raw streams flow to the cloud, you spend the rest of the project trying to contain a problem you created at the architecture stage.
- Privacy schemes are floor plans for data.
Major section
Start With Where the Data Lives (continued)
If you only need the intuition, this layer is enough: decide the geography of the data first.
- The floor plan is the scheme: it decides which rooms are private, where the doors are, and how people move between them.
- A good floor plan makes privacy effortless; a bad one leaves you hanging curtains forever.
- The Strategy Vocabulary Schemes are assembled from a small set of privacy design strategies, articulated by Jaap-Henk Hoepman.
Major section
Start With Where the Data Lives (continued)
This matters in everyday IoT because the largest privacy outcomes are settled by data geography.
- Process strategies Inform people honestly, give them control, enforce the policy in the system, and be able to demonstrate that you do.
- Splitting identity from sensor readings into separate stores is the separate strategy turned into a scheme boundary.
- If you can see why architecture geography settles most privacy outcomes, you have the core idea.
Major section
Choose the Smallest Data Path That Works
If a room dashboard only needs occupied or empty, do not build an architecture around storing every motion event first.
- Most IoT privacy schemes are variations on four shapes.
- Derive the result on the device; send a conclusion, not raw data.
- Boundaries must be enforced, not just drawn.
Major section
Choose the Smallest Data Path That Works (continued)
Data lives in a store the person controls; apps query under permission.
- User-owned data where portability and control are central.
- Products that need fleet insight without per-person tracking.
- The practitioner output is an evidence packet: a small set of artifacts that prove the scheme holds.
Major section
Choose the Smallest Data Path That Works (continued)
The packet is what an assessor or auditor reviews, and what a future change is checked against.
- Worked Reasoning: Three Products, Three Schemes Occupancy sensor Local-first: compute presence on the device, send only the occupied state.
- Raw motion never leaves, so most downstream risk disappears.
- If you can pick a scheme and assemble its evidence packet, you can stop here.
Major section
Make Every Boundary Prove Itself
Permission management and revocation must actually take effect.
- A scheme drawn on a diagram is a plan; a scheme that holds is one where every crossing is guarded and tested, including the quiet crossings through logs, caches, backups, and support tools.
- Raw data never leaves, so exposure cannot happen downstream.
- A personal data store adds permission machinery.
Major section
Make Every Boundary Prove Itself (continued)
The on-device result and update path must themselves be protected.
- Sensitive data is isolated, limiting how much can be combined.
- Each crossing needs a guard, or the zones are only labels.
- The person holds and grants access to their own data.
- De-identification must be genuine and resist re-linking.
Major section
Make Every Boundary Prove Itself (continued)
The protection comes from the boundary holding, not from either data set being secret on its own.
- A Boundary Is Only Real If It Is Enforced The recurring lesson is that drawing a zone boundary does nothing on its own.
- Schemes Have Trade-offs No scheme is free.
- Privacy zones add boundaries that must be maintained.
Major section
Make Every Boundary Prove Itself (continued)
An analytics boundary is only as good as its de-identification.
- A boundary becomes protective only when a control sits on every crossing and refuses traffic that breaks the rule.
- The same separation strategy that limits linkability fails the moment one unguarded path lets identity and readings be rejoined.
- At this depth, a privacy scheme is a deliberate geography of data backed by enforced, tested boundaries.
Major section
Choose a Privacy Scheme for a Shared Meter
In this privacy scheme, an apartment meter reports enough detail to manage demand, but minute-by-minute traces can reveal when a home wakes or cooks.
- No single privacy scheme covers every path, so the meter design combines controls around the stated energy purpose.
- Distinctive meter patterns may reconnect records across identifier changes.
Deck summary
Key takeaways
The privacy decision begins with where those answers are produced and whether the raw stream ever has to leave the device.
- A single technique, like a load-bearing wall, is a pattern.
- If you only need the intuition, this layer is enough: decide the geography of the data first.
- This matters in everyday IoT because the largest privacy outcomes are settled by data geography.
- If a room dashboard only needs occupied or empty, do not build an architecture around storing every motion event first.
Retrieval practice
Recall check 1 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q1What distinguishes a privacy scheme from a single privacy pattern?
Show answer
Answer: A The scheme is the floor plan that decides where data lives and crosses boundaries; patterns are the individual techniques arranged within it.
Retrieval practice
Recall check 2 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q2A smart speaker only needs to know whether a wake word was spoken to start a command. Which scheme best fits, and why?
Show answer
Answer: D Placing the boundary on the device means the raw stream is never exposed, which is the strongest geography for this need.
Retrieval practice
Recall check 3 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q3A design separates identifiers and sensor readings into two privacy zones, but a debug log in the readings zone records the matching identifier for each entry. Why does the scheme fail, and what is the fix?
Show answer
Answer: A A boundary only protects if every crossing, including logs, is guarded; an identifier in the readings log re-links what separation was meant to keep apart.
Print reference
Answers
Answer key.
- A · The scheme is the floor plan that decides where data lives and crosses boundaries; patterns are the individual techniques arranged within it.
- D · Placing the boundary on the device means the raw stream is never exposed, which is the strongest geography for this need.
- A · A boundary only protects if every crossing, including logs, is guarded; an identifier in the readings log re-links what separation was meant to keep apart.