Data protection by design, Art.25.1 of the GDPR Lina Jasmontaitė, VUB, LSTS Brussels Privacy Hub lina.jasmontaite@vub.be Based on Jasmontaite L., Kamara, I., Zanfir-Fortuna, G., and Leucci S., ‘Data Protection by Design and by Default: Framing guiding principles into legal obligations in the GDPR’, the European Data Protection Law Review (EDPL) Journal, 2nd ed., 2018, forthcoming

Elements of DPbD The controller… shall implement appropriate technical and organisational measures Designed to implement data protection principles… and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects In an effective manner Taking into account: The state of the art ... of the means for processing The cost of implementation The nature, scope, context of processing Purposes of processing Risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing At the time of the determination of the means for processing and at the time of the processing itself

DPbD challenge Designed to implement data protection principles… and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. The data protection principles listed in Article 5 of the GDPR; The rights of the data subject and The requirements of the GDPR = Compliance with the GDPR

Thank you! lina.jasmontaite@vub.be Any questions? Thank you! lina.jasmontaite@vub.be