 There are also several industry guidelines that can be used to design privacy preserving IT systems. The Payment Card Industry Data Security Standard (see PCI DSS v3.2, 2018, in the Other Internet Resources), for example, gives very clear guidelines for privacy and security sensitive systems design in the domain of the credit card industry and its partners (retailers, banks). Various International Organization for Standardization (ISO) standards (Hone &amp; Eloff 2002) also serve as a source of best practices and guidelines, especially with respect to information security, for the design of privacy friendly systems. Furthermore, the principles that are formed by the EU Data Protection Directive, which are themselves based on the Fair Information Practices (Gellman 2014) from the early 70s – transparency, purpose, proportionality, access, transfer – are technologically neutral and as such can also be considered as high level ‘design principles’. Systems that are designed with these rules and guidelines in mind should thus – in principle – be in compliance with EU privacy laws and respect the privacy of its users.