Privacy by Design

Privacy by design is a concept outlining the need to proactively incorporate and build privacy principle and practices from the start of a project, process, or system build and deployment through all stages of the lifecycle. Privacy concepts such as data minimization, proper data sharing, adequate notice, and purpose specification should be considered as early as possible to avoid costly mistakes and security and privacy issues down the road. 

A Privacy Impact Assessment (PIA) can be used by agencies to determine whether agency personnel have adequately considered privacy principles into their design, build, and implementation. Furthermore, a PIA can be used to review privacy risks, propose mitigations before the project proceeds, and ensure that privacy controls adequately reflect any compliance and regulatory requirements. A Privacy Impact Assessment questionnaire provides a series of questions to determine whether staff have adequately thought about privacy implications. Examples of questions are listed below:

• What specific legal authorities and/or agreements permit and define the collection of information by the system in question?
• Identify the information the system collects, uses, disseminates, or maintains. 
• What are the sources of the information and how is the information collected for the system?
• Discuss how accuracy of the data is ensured. 
• How does the system provide individuals notice prior to the collection of information? If notice is not provided, explain why not.
• What opportunities are available for individuals to consent to uses, decline to provide, or opt out of the system?
• What are the procedures that allow subject individuals to access their information? 
• What procedures are in place to allow the subject individual to correct inaccurate or erroneous information?