{"id":40893,"date":"2021-02-10T09:00:00","date_gmt":"2021-02-10T08:00:00","guid":{"rendered":"https:\/\/www.arca24.com\/en\/?p=40893"},"modified":"2021-02-10T10:11:37","modified_gmt":"2021-02-10T09:11:37","slug":"principles-of-privacy-by-design-and-privacy-by-default","status":"publish","type":"post","link":"https:\/\/www.arca24.com\/en\/principles-of-privacy-by-design-and-privacy-by-default\/","title":{"rendered":"The new guidelines relating to the principles of privacy by design and privacy by default"},"content":{"rendered":"

The new guidelines relating to the principles of privacy by design and privacy by default<\/span><\/h3>\n<\/div>
<\/div>

GDPR for HR<\/span><\/a> | 10.02.2021<\/p>\n<\/div>

In October 2020 the European Data Protection Board published the new guidelines relating to the principles of privacy by design and privacy by default. This is a clear message that privacy and protection of personal data are fundamental and necessary especially during the definition and the development of the operational processes.<\/em><\/h4>\n<\/div>
<\/div>
<\/span><\/div>
<\/div>

These new guidelines refer in particular to the interpretation of art. 25 of the GDPR. The developer must fully understand the principles of protection of personal data and the related rights and freedoms, developing adequate systems and protection measures necessary for the protection of personal data on the one hand and the freedom of development on the other.<\/p>\n

In the new guidelines, the principles of privacy by design and by default <\/strong>are further elaborated, as well as recommendations to developers and producers in order to achieve the personal data protection objectives, also through the adoption of specific certifications and codes of conduct.<\/p>\n

The principles of data protection by design must be implemented when the owner defines the methods used for the processing of personal data, taking into consideration factors such as the state of the art, the cost of the necessary implementations, the nature, the purpose, the context, the goal and the risk. It is therefore further underlined how in a context of cost-benefit analysis, the owner must immediately take into consideration the objective of privacy by design, as it could certainly be much more expensive to intervene afterwards to heal a process that has already started.<\/p>\n

Once the procedure has been initiated, the developer still has the burden of maintaining the defined standard, also taking into account the level of risk that could change during the development phase, which could also condition the owner to re-evaluate the already implemented safety measures.
\nThe new guidelines specify how this obligation to maintain \/ supervise \/ adapt the privacy system by design and by default is also mandatory with reference to systems pre-existing to the GDPR, which must therefore comply with the new guidelines if necessary.<\/p>\n

Privacy by default<\/strong>, on the other hand, refers to the choices inherent to the configuration and processing options provided in a system such as a software application. The owner must first define the reasons why personal data are collected and stored. It follows that by default, the owner cannot:<\/p>\n