Chapter 34 — Privacy and data protection: integration | Engineering Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 34 — Privacy and data protection: integration

Lesson map

Lesson 34 published. Map, example, EX100.

flowchart TD
  N0["Learning outcomes"]
  N1["34.1 Shared services"]
  N2["34.2 Laboratory partner"]
  N3["34.3 End-to-end tests"]
  N4["34.4 Change control"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX100"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["34.1 Shared services"]
  N2["34.2 Laboratory partner"]
  N3["34.3 End-to-end tests"]
  N4["34.4 Change control"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX100"]

[Learning outcomes]
    |
    v
[34.1 Shared services]
    |
    v
[34.2 Laboratory partner]
    |
    v
[34.3 End-to-end tests]
    |
    v
[34.4 Change control]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX100]

Learning outcomes

You will (1) integrate privacy controls across services; (2) handle partner integrations; (3) test integrated behaviour.

34.1 Shared services

By the fourth year Pellmore's privacy capabilities are spread across services: access checks, consent, retention, erasure and analytics. Zara integrates them through a shared privacy platform with clear interfaces. Each product service calls the platform rather than implementing its own logic. Integration reduces duplication and inconsistency, but it creates dependency: if the platform fails, many services are affected. She uses the fail-safe rules from Chapter 33 and runs the platform with high availability, treating it as critical infrastructure rather than a side project.

34.2 Laboratory partner

Pellmore's laboratory partner receives test orders and returns results. The partner is a separate controller for its own testing, as Zara determined using EDPB Guidelines 07/2020. Integration must respect both organisations' obligations. Zara designs the interface to send only the data needed for the test: a recipient-specific pseudonym, test type, sample identifier and clinically necessary details. Results return under the same pseudonym and are matched internally. She documents responsibilities in a data sharing agreement, including who answers which rights requests. The agreement is reviewed annually.

34.3 End-to-end tests

Zara builds end-to-end tests that cross services and partners using synthetic patients. A test patient books, consults, receives a test order, gets results, requests access and then erasure. The test checks that each step produces the expected data and that erasure reaches every Pellmore store and triggers notifications to the partner for its own handling. The first run reveals that the partner's results message includes the patient's full name in a free-text comment. Pellmore and the partner agree to remove names from comments.

34.4 Change control

Integrated systems change constantly. Zara sets a rule that any change to an interface carrying personal data needs a short privacy review and an update to the inventory. She automates detection: a schema comparison flags new fields in interface messages, and the review is triggered automatically. Prof. Holm points out that integration is where many privacy failures appear, because each team assumes another team handles a property, and that automated detection of interface changes reduces the reliance on people remembering to ask.

Worked example

Zara centralises privacy capabilities in a shared platform, designs a minimal pseudonymised lab interface, finds names in partner comments through end-to-end tests and automates privacy review of interface changes.

Synthetic case. The partner and tests are synthetic; EDPB Guidelines 07/2020 are real.

Errors and limits

A shared platform concentrates failure; monitor and test its availability.

Exercises

EX100 — Shared platform trade-off. What is the trade-off of a shared privacy platform? Rubric: 3 = less duplication but dependency on one critical service;; 2 = one part;; 1 = no trade-off;; 0 = none.
EX101 — Partner role. Why is the laboratory partner a separate controller? Rubric: 3 = it determines purposes and means for its own testing;; 2 = mentions independence;; 1 = processor;; 0 = none.
EX102 — Interface detection. How are interface changes caught for review? Rubric: 3 = automated schema comparison flags new fields;; 2 = mentions automation;; 1 = manual only;; 0 = none.

Synthesis

Chapter 34 integrates the platform. Chapter 35 is the second design studio.

Continue studying — chapter 34 of 50

← Chapter 33 (draft) · Course chapter index · Chapter 35 (draft) →