Chapter 31 — Privacy and data protection: implementation II | Engineering Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 31 — Privacy and data protection: implementation II

Lesson map

Lesson 31 published. Map, example, EX091.

flowchart TD
  N0["Learning outcomes"]
  N1["31.1 Portability"]
  N2["31.2 Vendor integration"]
  N3["31.3 Analytics redesign"]
  N4["31.4 Code quality"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX091"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["31.1 Portability"]
  N2["31.2 Vendor integration"]
  N3["31.3 Analytics redesign"]
  N4["31.4 Code quality"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX091"]

[Learning outcomes]
    |
    v
[31.1 Portability]
    |
    v
[31.2 Vendor integration]
    |
    v
[31.3 Analytics redesign]
    |
    v
[31.4 Code quality]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX091]

Learning outcomes

You will (1) implement data portability; (2) integrate a vendor's systems with rights handling; (3) implement privacy-preserving analytics.

31.1 Portability

Article 20 of the GDPR gives patients a right to receive data they provided, in a structured, commonly used and machine-readable format, where processing is based on consent or contract and carried out by automated means. Zara implements an export in a documented JSON format with a human-readable summary. She includes appointment history and patient-entered symptoms, and excludes clinicians' notes, which are covered by access rights but not portability. She documents the reasoning, because the boundary between portability and access is a common source of confusion for patients.

31.2 Vendor integration

The chat log gap found in the verification laboratory requires integration with the vendor. Zara designs an interface through which Pellmore can request a patient's chat logs and their deletion, with signed confirmations returned. The vendor agrees to the interface as part of its processor obligations under Article 28, which require assisting the controller with data subject rights. She tests the interface with synthetic patients and confirms that deletions are confirmed within the agreed two days, and that the confirmation is stored as evidence.

31.3 Analytics redesign

With the analytics SDK removed, Pellmore still needs to know how the app is used. Zara implements a server-side analytics pipeline that receives coarse events with recipient-specific pseudonyms, aggregates them daily and discards raw events after seven days. Dashboards show counts per feature and day, with counts below ten suppressed. She chooses not to collect device identifiers at all. The design gives product managers the information they need while removing the tracking that made the original SDK a high risk in the DPIA.

31.4 Code quality

Implementation work increases code size, and Zara reviews quality. She finds duplicated logic for pseudonymisation in three services and consolidates it into the shared library. She adds tests for edge cases such as patients with no appointments and very long chat histories. She also writes documentation for the export format so that patients and other providers can use it. Prof. Holm reminds her that maintainability affects privacy: duplicated logic drifts apart over time, and a forgotten copy can silently break a guarantee that everyone assumes still holds.

Worked example

Zara implements a JSON portability export, a vendor interface with signed deletion confirmations, server-side analytics with suppression of small counts and consolidates pseudonymisation code.

Synthetic case. Interfaces and data are synthetic; GDPR Articles 20 and 28 are real.

Errors and limits

Portability formats evolve; version the schema and keep old readers working.

Exercises

EX091 — Portability scope. What does portability include and exclude in Zara's design? Rubric: 3 = includes patient-provided data such as appointments and symptoms; excludes clinicians' notes;; 2 = one part;; 1 = everything;; 0 = none.
EX092 — Processor assistance. Which article obliges the vendor to help with rights requests? Rubric: 3 = Article 28;; 2 = mentions contract;; 1 = wrong;; 0 = none.
EX093 — Small-count suppression. Why suppress dashboard counts below ten? Rubric: 3 = small counts can point to individuals;; 2 = mentions privacy;; 1 = no reason;; 0 = none.

Synthesis

Chapter 31 implements more rights and analytics. Chapter 32 studies reliability of erasure.

Continue studying — chapter 31 of 50

← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →