Introduction to Privacy Engineering
[!TIP] Industry Best Practice: Always align this domain with standard frameworks like OWASP, NIST, or CIS benchmarks for optimal security posture.
Privacy by Design (PbD)
Privacy by Design is a framework that requires privacy to be considered at every stage of the engineering process. Coined by Dr. Ann Cavoukian, it is built on 7 foundational principles:
- Proactive not Reactive; Preventative not Remedial
- Privacy as the Default Setting
- Privacy Embedded into Design
- Full Functionality – Positive-Sum, not Zero-Sum
- End-to-End Security – Full Lifecycle Protection
- Visibility and Transparency – Keep it Open
- Respect for User Privacy – Keep it User-Centric
Core Privacy Engineering Concepts
Data Minimization
Only collect the data absolutely necessary to fulfill the stated purpose.
- Good: Asking for a user's zip code for regional weather forecasts.
- Bad: Asking for a user's exact GPS coordinates, full name, and birth date for the same weather forecast.
Purpose Limitation
Data should only be processed for the specific purpose it was collected for. Secondary processing requires separate consent or a distinct legal basis.
The Right to be Forgotten (Data Erasure)
Under frameworks like GDPR and CCPA, individuals have the right to request the deletion of their personal data. Implementing this technically requires tracking all data propagation through data lakes, backups, and caches, and having robust automated deletion mechanisms.
The Threat Landscape
Privacy threats differ from traditional security threats. While security focuses on preventing unauthorized access (e.g., data breaches), privacy focuses on the appropriate and legal handling of personal data, even by authorized users. Key privacy threats include:
- Linkability: The ability to link seemingly anonymous records back to an individual.
- Identifiability: Recovering PII from anonymized or aggregated datasets.
- Non-repudiation: In privacy contexts, sometimes users need plausible deniability, which standard auditing prevents.
- Detectability: The ability to deduce whether a specific individual's data is present in a dataset.