FORMAL ANSWER

The privacy by design principle means that the controller, both at the time of the determination of the means for processing and at the time of the processing itself, implements appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of GDPR and protect the rights of data subjects.

The privacy by default principle means implementing appropriate technical and organisational measures so that, by default, only personal data which are necessary for each specific purpose of the processing are processed. This obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures ensure that, by default, personal data are not made accessible to an indefinite number of natural persons without the intervention of the data subject.

PRACTICAL ANSWER

Privacy by design means taking data protection into account at the design stage — in other words, ensuring compliance with GDPR before data processing begins. For example: if we plan to launch a new product or service, we consider what the terms and conditions will be, which IT system will be used to deliver it, and which employees will be involved in the sales process. At this stage we should already answer questions such as: what data will we collect, where will customers find information about data processing, whether we will be able to provide or delete data easily upon request, and whether we will have data processing agreements in place (e.g. with the provider of the IT system).

Privacy by default means data protection by default. It means that, without additional consent or confirmation, only the minimum scope of data necessary to provide a given service may be processed. For example: if we can share information about ourselves via a social network, we should be asked to make that decision in advance, rather than being forced to search settings for options to hide certain information that is shared by default. Similarly, if we buy a product and provide personal data, the seller should not, without additional consent, enrol us in a loyalty programme, newsletter or competition.

MORE:

• You can find more information in the article: How to incorporate privacy at the design stage?