What is data protection by design and by default?

What it is

By design: take appropriate technical and organisational measures, such as pseudonymisation and minimisation, both when deciding the means of processing and when processing. By default: the default settings limit the amount of data collected, the extent of processing, retention and accessibility. The DUAA added that providers of information society services likely to be accessed by children must take account of how children can best be protected and supported, given that they may be less aware of the risks.

When it applies

• When designing any new system, product, service or process that uses personal data. UK GDPR Art 25(1)
• In the default settings of every system, so data is not made accessible to an indefinite number of people without the person acting. Art 25(2)
• For online services likely to be accessed by children: children's higher protection matters. Art 25, as amended by DUAA s.81

Who is responsible

The controller. Processors and producers should support it, and controllers should choose suppliers that do.

What it involves

1. Consider data protection at the requirements stage.
2. Minimise data and set privacy-friendly defaults.
3. Pseudonymise or anonymise where you can.
4. Document the choices, often in a DPIA.
5. For children's services, apply the Children's code.

If it goes wrong

Regulatory

Breach of Art 25. A breach of this duty sits in the standard tier of penalties: up to £8.7 million or 2% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice.

Criminal

No offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.