Privacy-by-default og privacy-by-design

In a world where our lives are increasingly digitised, the protection of our personal information is central. Two key terms that are often thrown around are “Privacy-by-default” and “Privacy-by-design”. These terms represent two different approaches to protecting our personal data online. This blog is about these two concepts, as understanding them is essential to navigating the complex landscape of digital services and technologies.

“Privacy-by-default”  (or “data protection by default”) refers to the principle that you should automatically enable and apply privacy settings and protections when people use your product or service for the first time. A person should not have to opt-in or configure them. Default settings and policies should:

• Prioritise the protection of users’ personal information
• Limit the collection and use of data to the minimum necessary

“Privacy-by-design” (or “data protection by design”) refers to the principle that you should integrate privacy considerations into the design and development of products, services, and systems from the earliest stages. They should not be added as an afterthought. This means you should:

• Identify and mitigate privacy risks
• Build data protection into the product or service from the ground up

Many data regulations and laws across the world, like GDPR, CCPA, and PDPA, require companies to put the principles of privacy by design and default into their products and apps. However, regulations allow companies to determine which specific protective measures they should “build in” and exactly how settings must be configured. This leaves a lot of companies confused about how to apply these principles in practice. Let’s look at a few examples that can help you.

Here are some examples of how you can use the principle of privacy by default at your company for data protection:

• Minimise the personal data you store
• Limit collection of personal data to what you need
• Use opt-in consents like unchecked consent boxes.
• Give users clear and accurate info about your data processing activities.
• Do not make your Yes buttons more prominent than your No buttons.
• Do not give misleading information when getting consent.
• Avoid other dark patterns when getting consent.
• Do not require people to accept data processing or cookies to use your website.
• Do not make personal data publicly available automatically.

Here are some examples of how you can use principle of privacy-by-design in your business and services, and the solutions you use for data protection:

• Schedule regular privacy risk assessments
• Use pseudonymisation and encryption
• Set up to catch all data subjects’ rights requests and fulfill them
• Set a reasonable data retention period
• Auto-delete or anonymise personal data you no longer need

Data protection by design and default are complementary principles. Put both in practice by:

1. Ensure that data protection is built into your tools, systems and processes
2. Make it easy and automatic for people to protect their data when they shop with you, are on your website, use your services, etc.
3. Build your policies and practices on these principles. The same applies to the software you use, regardless of whether you develop it yourself or subscribe to it.

At Safe Online, we have created the GDPR platform PrivacyHub, which is based on these principles. PrivacyHub includes these three tools: