The 7 foundational principles of Privacy by Design work to embed privacy in any product, service, system or process.
Privacy by Design can help an agency meet the Government Chief Privacy Officer’s core expectations. Privacy by Design is a design methodology that includes privacy as an essential priority of any product, service, system or process.
Privacy is embedded throughout the product or service lifecycle from design to disposal. The benefits of using PbD include:
increased awareness of privacy and handling of personal information across an agency’s projects, products, services, systems or processes
early identification and resolution of potential privacy risks and issues (when it’s simpler and less costly to do so)
greater assurance of meeting the Information Privacy Principles of the Privacy Act.
The 7 principles for Privacy by Design
These principles — and the philosophy and methodology they express — can be applied to specific technologies, business operations, physical architectures, networked infrastructure, and entire information ecosystems.
The key to instilling PbD principles is to undertake ongoing communication and education with senior leadership, colleagues and staff.
1. Proactive not reactive, preventative not remedial
Privacy needs to be part of the planning of any new or updated product, service, system or process. Privacy considerations should help drive the design rather than being bolted on at the end to address a few privacy risks.
2. Privacy as the default
The default setting of any design should protect the individual’s personal information by understanding how the Information Privacy Principles apply in this context.
3. Privacy embedded into design
Privacy should be so integral to the design of the product, service, system or process that it would not function without the privacy-preserving functionality.
4. Full functionality — positive-sum, not zero-sum
Design requirements to protect personal information should be treated as an opportunity to design a better product, service, system or process, not as a trade-off with other functionality.
5. End-to-end security — lifecycle protection
Protection and security of personal information should be considered for every stage of the information lifecycle: collection, storage and security, use, access and correction, disclosure, retention and disposal.
6. Visibility and transparency
How the product, service, system or process will use the personal information needs to be clear to the individual providing the personal information. The accompanying privacy notice should be written in easy-to-understand, audience-appropriate language.
7. Respect for user privacy — keep it user-centric
At the centre of any design for product, service, system or process is a person who will use that product, service, system or process. It’s that person who will bear the harm and impact of any privacy breach or misuse of their personal information.
