Privacy & Security by Design
Privacy and Security by design is a regulatory approach established by the EU General Data Protection Regulation (GDPR). It requires data controllers and/or controllers to implement technical and organisational measures in order to mitigate privacy and security risks. One of the main instruments for demonstrating compliance with the requirements of privacy and security by design, just as with legal requirements in general, are certificates and codes of conduct. These mechanisms enable data controllers and processors to create trust amongst its customers in their data-driven products and services, and to use this is a core value and competitive advantage on the market.
Technological and Data-Driven Innovation
Technological and data-driven innovation is the core driver of public welfare in our digitized society. Data-driven innovations can solve many problems of society, through both the private and public sector: Transport, logistics, product and service development, administration, communication, finance, health, and science in general.
Data-driven innovation can also create risks for individuals and even the society as a whole. For example, data-driven innovation can be misused by people who illegitimately intrude into an individuals’ privacy, engage in unjustified discrimination against people, or who monitor society at large.
Controlling Risks of Data-Driven Innovation
Enhancing Trust in Data-Driven Products/Services
Therefore, in order to fully exploit the positive effects of data-driven innovation, it is necessary to control its risks. Customers can only trust in data-driven products and services if the risks are controlled, and data controllers and processors can only then fully exploit the commercial benefits of data-driven innovation.
The new General Data Protection Regulation builds upon this approach by establishing broad legal terms and general principles, which leave data controllers and processors a large room of manoeuvre for applying these requirements during their innovation processes. In order to make sure that their specific application meets the regulator’s expectations, controllers and processors can additionally build and/or use certificates or codes of conduct demonstrating the legal compliance.
Exploiting Competitive Advantages
GDPR Standardisation Instruments
Data controllers and processors can develop new certificates or use existing ones in order to demonstrate the compliance of certain processing activities. This might imply certain product or service categories. A certificate is the ideal instrument to signal compliance as a core value of the product or service and to compete with it against other providers of products or services of the same category, which may have a lower data protection level.
Certificates
Data controllers and processors can build new certificates or use existing ones in order to demonstrate compliance for certain processing activities. This might imply certain product or service categories. A certificate is the ideal instrument in order to signal compliance as a core value of the product or service and to compete with it against other providers of products or services of the same category, which possibly have a lower data protection level.
Codes of Conduct
Data controllers and processors can also set up or use codes of conduct for a certain processing sector. In contrast to certificates, a code of conduct not only demonstrates compliance for a certain processing activity (or product or service), but for a whole bundle of activities typical in that sector. However, since the scope of application of a code of conduct is wider than a certificate, it is more complex to set it up.
Binding Corporate Rules
Similar to a code of conduct, binding corporate rules do not only refer to a certain processing activity but to a bundle of activities. However, while a code of conduct focuses on a processing sector, binding corporate rules apply to one company. Binding corporate rules are particularly useful for globally operating companies because they can legitimize the transfer of personal data within the company, irrespective of whether this occurs inside or outside the EU.
Advantages
Service Packages
Privacy Impact Assessments
Including multi-stakeholder processes
Analysis of Data Protection Laws
Focus on the GDPR and the ePrivacy Regulation
Privacy and Security by Design Solutions
Conceptualisation, Development and Support
State of the Art Research
Monitoring privacy and security by design solutions
Competitive Advantages
Consultancy on innovation strategies
Standardisation Strategies
Consultancy regarding data protection and security
Certificates, Codes of Conduct, BCR
Consultancy, concpetualisation, support
Innovative Data Protection Events
E.g. legal Hackathons and educational Game Jams
Network
Max von Grafenstein
Lawyer
Partner at iRights.Law
Head of Research „Governance of Data-Driven Innovation“ at Alexander von Humboldt Institute for Internet and Society
Jan Schallaböck
Lawyer
Founding Partner at iRights.Law
Vice-Convener to the ISO/IEC Working Group on privacy and identity management
Marcel Hebing
Data Scientist
Founder of mStats DS
Researcher at German Institute for Economic Research and Alexander von Humboldt Institute for Internet and Society
Lies van Roessel
Game Studies Expert
Researcher at Hans-Bredow-Institut for Media Research
Associated Researcher at Alexander von Humboldt Institute for Internet and Society
Ame Elliott
Design Innovation Expert
Design Director Simply Secure
Former design research lead for innovation consultancy IDEO and Silicon Valley research scientist at Xerox PARC and Ricoh Innovations
Eva Schneider
Ethics and Information Expert
Doctoral Candidate at Technische University Berlin
Scholarship Holder at Else Neumann Stiftung
Katharina Beitz
Communication Expert
Founder
Researcher at Alexander von Humboldt Institute for Internet and Society
Jessica Schmeiss
Business Model Expert
Researcher “Customer Centric Business Model Innovation” at Alexander von Humboldt Institute for Internet and Society
Scholarship Holder at Stiftung der Deutschen Wirtschaft
Advisory Board
Prof. Dr. Dr. Thomas Schildhauer
Computer Scientist and Marketing Expert
Professor at University of the Arts
Director at Alexander von Humboldt Institute for Internet and Society
Prof. Dr. Wolfgang Schulz
Co-regulation expert
Professor at University of Hamburg
Director at Alexander von Humboldt Institute for Internet and Society