 The rules and principles described above give high-level guidance for designing privacy-preserving systems, but this does not mean that if these methodologies are followed the resulting IT system will (automatically) be privacy friendly. Some design principles are rather vague and abstract. What does it mean to make a transparent design or to design for proportionality? The principles need to be interpreted and placed in a context when designing a specific system. But different people will interpret the principles differently, which will lead to different design choices, with different effects on privacy. There is also a difference between the design and the implementation of a computer system. During the implementation phase software bugs are introduced, some of which can be exploited to break the system and extract private information. How to implement bug-free computer systems remains an open research question (Hoare 2003). In addition, implementation is another phase wherein choices and interpretations are made: system designs can be implemented in infinitely many ways. Moreover, it is very hard to verify – for anything beyond non-trivial systems – whether an implementation meets its design/specification (Loeckx, Sieber, &amp; Stansifer 1985). This is even more difficult for non-functional requirements such as ‘being privacy preserving’ or security properties in general. 