Chapter 25 — Design studio I | Engineering Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 The brief"]
  N2["25.2 Alternatives"]
  N3["25.3 Automated decisions"]
  N4["25.4 Critique"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 The brief"]
  N2["25.2 Alternatives"]
  N3["25.3 Automated decisions"]
  N4["25.4 Critique"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 The brief]
    |
    v
[25.2 Alternatives]
    |
    v
[25.3 Automated decisions]
    |
    v
[25.4 Critique]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) design a privacy-preserving feature end to end; (2) present design alternatives; (3) respond to critique in a studio setting.

25.1 The brief

In the first design studio Zara's team receives a brief: design symptom triage for Pellmore's app that suggests whether a patient needs a video consultation, a pharmacist or emergency care. The feature needs symptoms, which are health data. The team must minimise data, explain the logic to patients and avoid storing more than needed. Prof. Holm adds a constraint: the design must work if the patient refuses analytics. The brief forces the team to treat privacy as a design input from the first sketch rather than a review at the end.

25.2 Alternatives

The team sketches three alternatives. In the first, symptoms are sent to a server that runs the triage model and stores answers for improvement. In the second, the model runs on the phone and nothing leaves the device unless the patient books. In the third, answers are sent but deleted after the result is shown. Zara evaluates each for data collected, transparency, accuracy and cost. On-device triage collects least, but updating the model is harder and some older phones may not run it.

25.3 Automated decisions

The triage suggests a course of action, which raises the question of automated decision-making. Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing that significantly affects them, with exceptions. Zara's team designs the triage as advice with a clear option to speak to a clinician, so that no patient is denied care by the algorithm alone. They also explain the main factors in plain language, which supports transparency even where Article 22 might not strictly apply.

25.4 Critique

Studio critics, including a clinician, challenge the on-device design: if answers are never stored, how will the team learn that triage is unsafe? Zara proposes an opt-in feedback route and a periodic clinical review using synthetic test cases. The critics accept the approach but ask for a safety monitoring plan. Zara learns that privacy and clinical safety must be designed together, and that critique in a studio is most useful when designers explain trade-offs openly rather than defending one option as perfect.

Worked example

Zara's team designs symptom triage with three alternatives, prefers on-device processing, frames the result as advice with a clinician option and adds opt-in feedback and synthetic safety tests.

Synthetic case. The studio and feature are synthetic; GDPR Article 22 is real.

Errors and limits

On-device processing still needs a secure update channel and may leak through crash reports.

Exercises

EX073 — Least-collecting option. Which alternative collects least data, and what is its drawback?
Show marking criteria
Rubric: 3 = on-device triage; model updates are harder and older phones may not cope;; 2 = one part;; 1 = server option;; 0 = none.
EX074 — Article 22 design. How does the team avoid a solely automated decision?
Show marking criteria
Rubric: 3 = triage is advice with a clear option to speak to a clinician;; 2 = mentions human;; 1 = ignores;; 0 = none.
EX075 — Learning without storage. How can the team learn about unsafe triage without storing answers?
Show marking criteria
Rubric: 3 = opt-in feedback and clinical review with synthetic cases;; 2 = one part;; 1 = store everything;; 0 = none.

Synthesis

Chapter 25 designs a feature. Chapter 26 compares architecture alternatives.

Continue studying — chapter 25 of 50

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →