(Informed, explicit, consent mechanisms should explicitly incorporate mechanisms of unambiguous) comprehension, consciousness, limitations, and choice. Context Users should/must be able to change privacy preferences according to context. Situational or physical context—such as crowded situations (for example, when at a service desk where several people can listen in on your exchange (User adjusting when you provide a phone number, or when you are in the subway with preferences as cameras and audio on wearables around you)—is different from when you perform a buy transaction with Amazon.com or provide information to an app conditions require) registered with an aggregator that sells to advertisers. Data also has context (such as the sensitivity of data, for example, financial and health data) could dictate different actions on the same PII in different contexts. Confinement Users must/should be able to set/request limits on who may access their PII, for what purposes, and where and possibly when/how long it may be stored. Setting limits could provide some good opportunities for future negotiation (Data minimization, between vendors and users. proportionality, and user-controlled re-use of data) Consistency Users should anticipate with reasonable certainty what will occur if any action involving their PII is taken. That is, certain actions should be predictable on user access of PII or giving out of PII. (User predictability of outcome of transactions) Privacy by Design and Design Patterns [This section will be developed in a future version.] Coding / Development This section describes software engineering tools and techniques for operationalizing Privacy by Design into the coding / development phase of the software development life cycle. [Note that the name / development” is used instead of in order to prevent confusion “coding “implementation” with implementation in the sense of end-user deployment. Tabled for a future version] Testing / Validation This section describes software engineering and techniques for operationalizing Privacy by Design into the testing / validation phase of the software development life cycle. [This section will be developed in a future version. Validation and Verification Develop tests at the same time you develop requirements. – Reference OWASP for Penetration testing/ Code Review including code scanning (security)]
(Informed, explicit, unambiguous) consent mechanisms should explicitly incorporate mechanisms of comprehension, consciousness, limitations, and choice. Context (User adjusting preferences as conditions require) Users should/must be able to change privacy preferences according to context. Situational or physical context—such as crowded situations (for example, when at a service desk where several people can listen in on your exchange when you provide a phone number, or when you are in the subway with cameras and audio on wearables around you)—is different from when you perform a buy transaction with Amazon.com or provide information to an app registered with an aggregator that sells to advertisers. Data also has context (such as the sensitivity of data, for example, financial and health data) could dictate different actions on the same PII in different contexts. Confinement (Data minimization, proportionality, and user-controlled re-use of data) Users must/should be able to set/request limits on who may access their PII, for what purposes, and where and possibly when/how long it may be stored. Setting limits could provide some good opportunities for future negotiation between vendors and users. Consistency (User predictability of outcome of transactions) Users should anticipate with reasonable certainty what will occur if any action involving their PII is taken. That is, certain actions should be predictable on user access of PII or giving out of PII. Privacy by Design and Design Patterns [This section will be developed in a future version.] Coding / Development This section describes software engineering tools and techniques for operationalizing Privacy by Design into the coding / development phase of the software development life cycle. [Note that the name “coding / development” is used instead of “implementation” in order to prevent confusion with implementation in the sense of end-user deployment. Tabled for a future version] Testing / Validation This section describes software engineering and techniques for operationalizing Privacy by Design into the testing / validation phase of the software development life cycle. [This section will be developed in a future version. Validation and Verification – Develop tests at the same time you develop requirements. Reference OWASP for Penetration testing/ Code Review including code scanning (security)]