6.2–Open to Review: The design collection, use, disclosure, and/or and operation of software systems elsewhere as applicable should demonstrably satisfy the MUST describe any measurements strongest privacy laws, contracts, incorporated in the software, or policies and norms (as required). monitoring software, or otherwise to 6.3–Open to Emulation: The measure the usage and effectiveness design and operation of of provided privacy options and information controls, and to ensure continuous technologies and systems should improvement. be open to scrutiny, improvement, MUST describe placement of privacy praise, and emulation by all. settings, privacy controls, privacy policy(ies), and accessibility, prominence, clarity, and intended effectiveness. 7. Respect for User 7.1–Anticipate and Inform: MUST describe user privacy options Privacy Software should be designed with (including access), controls, user user/data subject privacy interests privacy preferences/settings, UI/UX in mind, and convey privacy supports, and user-centric privacy attributes (where relevant) in a model. timely, useful, and effective way. MUST describe notice, consent, and 7.2–Support Data Subject Input other privacy interactions at the and Direction: Technologies, EARLIEST possible point in a data operations and networks should transaction exchange with a user/data allow users/data subjects to subject or her/his automated agent(s) express privacy preferences and or device(s). controls in a persistent and effective way. 7.3–Encourage Direct User/Subject Access: Software systems should be designed to provide data subjects direct access to data held them, and an account of uses and disclosures.
6.2–Open to Review: The design and operation of software systems should demonstrably satisfy the strongest privacy laws, contracts, policies and norms (as required). 6.3–Open to Emulation: The design and operation of information technologies and systems should be open to scrutiny, improvement, praise, and emulation by all. collection, use, disclosure, and/or elsewhere as applicable MUST describe any measurements incorporated in the software, or monitoring software, or otherwise to measure the usage and effectiveness of provided privacy options and controls, and to ensure continuous improvement. MUST describe placement of privacy settings, privacy controls, privacy policy(ies), and accessibility, prominence, clarity, and intended effectiveness. 7. Respect for User Privacy 7.1–Anticipate and Inform: Software should be designed with user/data subject privacy interests in mind, and convey privacy attributes (where relevant) in a timely, useful, and effective way. 7.2–Support Data Subject Input and Direction: Technologies, operations and networks should allow users/data subjects to express privacy preferences and controls in a persistent and effective way. 7.3–Encourage Direct User/Subject Access: Software systems should be designed to provide data subjects direct access to data held them, and an account of uses and disclosures. MUST describe user privacy options (including access), controls, user privacy preferences/settings, UI/UX supports, and user-centric privacy model. MUST describe notice, consent, and other privacy interactions at the EARLIEST possible point in a data transaction exchange with a user/data subject or her/his automated agent(s) or device(s).