June 11, 2018

Considering the role of technology in society, in particular whether companies should be able to take advantage of it exclusively as a means to increase their profits, or whether they should be obliged to use it to further the interests of users and the common good, the EDPS says that the principle of privacy by design is “an efficient way to reconcile economic interests and social objectives”. It involves planning for the integration of personal data protection into new technological systems and processes from the initial design stage of a project, as well as throughout its whole lifecycle.

The EDPS explains that privacy by design, and the complementary principle of privacy by default (which involves ensuring that privacy protection is integrated into all technological services and products as a default setting) are both now enshrined in the GDPR. What was previously considered to be just good practice is now a legal obligation for all organisations responsible for processing personal data. This fits into the wider accountability principle, also defined in the GDPR, which requires organisations to implement appropriate technical and organisational methods to ensure and demonstrate data protection compliance.

In the EDPS’s view, the successful implementation of the principles of privacy and data protection by design and by default is “essential in order to guarantee effective protection for individuals”. It is also an important step in the development of digital ethics.

The aim of the Opinion is to start a debate on the role and development of technology in society. The Opinion sets out the history of the principle of privacy by design within and outside the EU, from the initial research on privacy enhancing technologies to the GDPR, provides examples of engineering methodologies and standardisation efforts and explores the meaning of privacy by design within the GDPR. To access the preliminary Opinion, click here.