Chapter 20 — Privacy and data protection: engineering context
Lesson map
Lesson 20 published. Map, example, EX058.
flowchart TD
N0["Learning outcomes"]
N1["20.1 Laws that apply"]
N2["20.2 Controllers and processors"]
N3["20.3 Frameworks and standards"]
N4["20.4 The engineer's role"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX058"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["20.1 Laws that apply"]
N2["20.2 Controllers and processors"]
N3["20.3 Frameworks and standards"]
N4["20.4 The engineer's role"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX058"]
[Learning outcomes]
|
v
[20.1 Laws that apply]
|
v
[20.2 Controllers and processors]
|
v
[20.3 Frameworks and standards]
|
v
[20.4 The engineer's role]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX058]
Learning outcomes
You will (1) map the legal framework that shapes Pellmore's engineering; (2) identify roles of controller and processor; (3) relate standards and frameworks to engineering work.
20.1 Laws that apply
Pellmore serves patients in the EU and Brazil, so both the GDPR and the LGPD, Lei 13.709/2018, apply. Both define principles such as purpose limitation and necessity, rights for individuals and duties for organisations. Both treat health data as especially sensitive: GDPR Article 9 and LGPD Article 11 restrict processing to specific grounds. Zara builds a table comparing the two laws on legal bases, rights, breach notification and the role of a data protection officer, so that engineering requirements can be stated once and satisfy both.
20.2 Controllers and processors
Zara learns the difference between a controller, who decides why and how data are processed, and a processor, who acts on the controller's behalf. Pellmore is the controller for patient records; the video vendor is a processor. Laboratory partners may be separate controllers for their own testing. The roles determine who is responsible for what, including rights requests and breach notification. EDPB Guidelines 07/2020 explain the concepts in detail, and Zara uses them to label each node in her data-flow graph from Chapter 2.
20.3 Frameworks and standards
Beyond law, Zara studies frameworks. The NIST Privacy Framework 1.0 organises privacy risk management into functions such as Identify-P, Govern-P, Control-P, Communicate-P and Protect-P. ISO/IEC 29100 defines privacy principles and terms, and ISO/IEC 27701:2025 specifies a privacy information management system. She uses the NIST functions to group her engineering work: inventories under Identify-P, access controls under Protect-P and notices under Communicate-P. Frameworks, she notes, help organise work but do not replace legal analysis. Legal questions, such as which lawful basis applies to a new research use, still need counsel.
20.4 The engineer's role
Prof. Holm closes the first two years by asking what an engineer contributes to data protection. Zara answers that lawyers interpret obligations, but engineers decide how systems actually behave. A retention rule exists only if code deletes data; a right of access exists only if systems can find a person's data. Data protection by design, required by GDPR Article 25, places responsibility on the controller to build these capabilities into systems. Engineers are therefore central to whether data protection is real or only written down.
Worked example
Zara compares GDPR and LGPD, labels controllers and processors on her flow graph, organises work with the NIST Privacy Framework functions and defines the engineer's role through Article 25.
Synthetic case. Pellmore's roles are synthetic; the GDPR, LGPD, EDPB Guidelines 07/2020, NIST Privacy Framework 1.0, ISO/IEC 29100 and ISO/IEC 27701:2025 are real.
Errors and limits
The comparison table simplifies; national laws and regulators add detail.
Exercises
- EX058 — Health data grounds. Which articles restrict health data processing in GDPR and LGPD? Rubric: 3 = GDPR Article 9 and LGPD Article 11;; 2 = names one;; 1 = wrong;; 0 = none.
- EX059 — Controller versus processor. Is the video vendor a controller or a processor, and why? Rubric: 3 = processor; it acts on Pellmore's behalf;; 2 = says processor;; 1 = says controller;; 0 = none.
- EX060 — Engineer centrality. Why are engineers central to data protection? Rubric: 3 = systems' behaviour decides whether rights and retention are real;; 2 = mentions implementation;; 1 = says lawyers decide;; 0 = none.
Synthesis
Chapter 20 frames the legal and standards context. Chapter 21 writes privacy requirements.
Continue studying — chapter 20 of 50
← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →