What element of the Privacy by Design (PbD) framework might the Handy Helper violate?

SCENARIO

Please use the following to answer the next QUESTION:

Manasa is a product manager at Omnipresent Omnimedia, where she is responsible for leading the development of the company’s flagship product, the Handy Helper. The Handy Helper is an application that can be used in the home to manage family calendars, do online shopping, and schedule doctor appointments. After having had a successful launch in the United States, the Handy Helper is about to be made available for purchase worldwide.

The packaging and user guide for the Handy Helper indicate that it is a "privacy friendly" product suitable for the whole family, including children, but does not provide any further detail or privacy notice. In order to use the application, a family creates a single account, and the primary user has access to all information about the other users. Upon start up, the primary user must check a box consenting to receive marketing emails from Omnipresent Omnimedia and selected marketing partners in order to be able to use the application.

Sanjay, the head of privacy at Omnipresent Omnimedia, was working on an agreement with a European distributor of Handy Helper when he fielded many Questions about the product from the distributor. Sanjay needed to look more closely at the product in order to be able to answer the

Questions as he was not involved in the product development process.

In speaking with the product team, he learned that the Handy Helper collected and stored all of a user’s sensitive medical information for the medical appointment scheduler. In fact, all of the user’s information is stored by Handy Helper for the additional purpose of creating additional products and to analyze usage of the product. This data is all stored in the cloud and is encrypted both during transmission and at rest.

Consistent with the CEO’s philosophy that great new product ideas can come from anyone, all Omnipresent Omnimedia employees have access to user data under a program called Eureka. Omnipresent Omnimedia is hoping that at some point in the future, the data will reveal insights that could be used to create a fully automated application that runs on artificial intelligence, but as of yet, Eureka is not well-defined and is considered a long-term goal.

What element of the Privacy by Design (PbD) framework might the Handy Helper violate?
A . Failure to obtain opt-in consent to marketing.
B . Failure to observe data localization requirements.
C . Failure to implement the least privilege access standard.
D . Failure to integrate privacy throughout the system development life cycle.

View Answer

Answer: D

Explanation:

The Handy Helper might violate the element of the Privacy by Design (PbD) framework that requires integrating privacy throughout the system development life cycle. According to the PbD framework, privacy should be embedded into the design and architecture of IT systems and business practices, not added as an afterthought1 This means that privacy should be considered at every stage of the system development life cycle, from planning to analysis to design to development to implementation to maintenance2 However, the Handy Helper seems to have been developed without involving Sanjay, the head of privacy, or conducting a privacy impact assessment (PIA) to identify and mitigate potential privacy risks3 The product also lacks a clear and transparent privacy notice that informs users about what data is collected, how it is used, where it is stored, who has access to it, and what choices they have4 These issues could expose the product to legal and reputational challenges, especially in regions with strict data protection regulations, such as Europe.

Reference: 1: Privacy by Design – The LIFE Institute; 2: System Development Life Cycle – GeeksforGeeks; 3: [Privacy Impact Assessment (PIA) | NZ Digital government]; 4: [Privacy Notices under EU Data Protection Law | Privacy International]