I was invited to the Future of Privacy Forum’s (FPF) workshop on Privacy Engineering in Leuven (Belgium). The Internet Privacy Engineering Network IPEN supported it and compared to past IPEN workshops the number of participants increased a lot which also shows the growing importance of the topic. Privacy Engineering as a subset of Data Protection by Design, which is a requirement of the GDPR, is becoming an important discipline to implement privacy in software and the workshop aimed to discuss practical issues and develop guidelines for software developers and architects.

In the morning, it started with presentations from Giovanni Buttarelli (European Data Protection Supervisor) and Norman Sadeh from Carnegie Mellon University who developed tools to semi-automatically analyze privacy policies (see https://usableprivacy.org/). Later on Wojciech Wiewiorowski (Assistant European Data Protection Supervisor) pointed out that there is not always an easy solution (or “silver-bullet”) for Privacy by Design as people would like to have and compares the situation with his 10 year-old daughter that rather pretends to believe in Santa Claus and sends him her wish list instead of discussing it with her parents.

In the afternoon five breakout sessions were organized. In my group, the challenges arising from development and deployment practices have been discussed and how data protection by design methodologies can be integrated into existing software development approaches. The most important questions were about how to integrate Data Protection Impact Assessments (PIA) and a risk-based approach into the Software Development Process and about the challenges of software modularity and integration of third party code.

EDPS aims to publish a Privacy by Design guidance in the beginning of next year that will consider the issues identified in the workshop. Further information about the event and its results are available on Twitter.