Privacy Engineering, Privacy by Design, and Emerging Technology
What this domain tests
This domain tests whether you can build privacy into a product rather than bolting it on. Questions ask which engineering technique reduces risk in a given design, how Art 25 applies by default, and how to treat AI and other emerging technology.
Core rules
- Privacy by Design (Cavoukian's seven principles). Proactive not reactive; privacy as the default; embedded into design; full functionality or positive-sum; end-to-end security; visibility and transparency; respect for user privacy.
- GDPR Art 25. Data protection by design and by default: technical and organisational measures, minimisation of data, extent of processing, retention and accessibility by default, with pseudonymisation encouraged.
- De-identification. Pseudonymised data remains personal data (Recital 26) because re-identification is possible. Anonymisation must be irreversible in practice. k-anonymity, l-diversity and t-closeness mitigate but do not eliminate re-identification when datasets are combined.
- Privacy-enhancing technologies. Differential privacy with a tracked epsilon budget; synthetic data with fidelity checks; homomorphic encryption; secure multi-party computation; private set intersection; trusted execution environments; on-device processing and aggregation.
- Consent engineering. Consent management platforms, granular choices, no dark patterns, honouring preference signals such as Global Privacy Control.
- Emerging tech. AI and generative models raise training-data provenance, lawful basis, memorisation, model inversion and vendor model terms. The EU AI Act adds risk classification, duties for general-purpose models, and fundamental rights impact assessment for high-risk uses.
Worked example
An analytics team wants user-level event data for a dashboard. Apply minimisation: aggregate to cohort level, add differential privacy noise with a declared epsilon budget, cap retention, block raw export, and screen the design through DPIA triage. Reasoning: reduce identifiability first, then constrain retention and access, then document the decision so the residual risk is explicit rather than accidental.
Traps that cost marks
Calling pseudonymised data anonymous; using consent as the fix for over-collection; ignoring re-identification from dataset linkage; treating the epsilon budget as unlimited; assuming Art 25 applies only to opt-in features rather than the product default.