Chapter 35 — Design studio II | Engineering Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 35 — Design studio II

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 The brief"]
  N2["35.2 Granular sharing"]
  N3["35.3 Vulnerable patients"]
  N4["35.4 Panel presentation"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 The brief"]
  N2["35.2 Granular sharing"]
  N3["35.3 Vulnerable patients"]
  N4["35.4 Panel presentation"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX103"]

[Learning outcomes]
    |
    v
[35.1 The brief]
    |
    v
[35.2 Granular sharing]
    |
    v
[35.3 Vulnerable patients]
    |
    v
[35.4 Panel presentation]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) design a new data use with contextual integrity; (2) consider vulnerable groups; (3) present to a mixed panel.

35.1 The brief

The second studio brief asks Zara's team to design a feature that lets family carers help elderly patients manage appointments. Carers need some information but not all, and patients may have reasons to keep some consultations private from relatives. The team must design sharing that respects the patient's wishes. Nissenbaum's contextual integrity guides them: information shared with a clinician carries norms of confidentiality, and moving it to a family member requires the patient's informed choice about what moves and when. Patients choose per category.

35.2 Granular sharing

The team designs sharing by category: appointment times, medication reminders and test results can each be shared or not. Consultation notes are never shared by default. Patients choose categories at setup and can change them at any time. The carer sees a clear label of what has been shared. Zara ensures that a sharing setting cannot be changed by the carer, only by the patient or, where the patient lacks capacity, by a legally authorised representative, with that authority verified rather than merely claimed.

35.3 Vulnerable patients

The panel raises cases of coercion: a controlling relative might pressure a patient to share everything. The team adds a private review prompt: at random times, when the patient logs in alone, the app asks whether sharing settings still reflect their wishes, with a discreet option to change them. They also train clinicians to ask about sharing during consultations. Zara notes that WP248 lists vulnerable data subjects as a factor in assessing risk, and that design for vulnerable users often improves the experience for everyone.

35.4 Panel presentation

The team presents to a panel of a clinician, a carer, a patient representative and an engineer. The patient representative asks for simpler wording; the carer asks for notifications when sharing changes; the clinician asks how emergencies are handled. The team adds plain-language labels and notifications, and clarifies that emergencies follow clinical procedures outside the sharing feature. Zara reflects that a mixed panel catches problems that engineers alone would miss, and that privacy design is strongest when people affected by it help shape it.

Worked example

Zara's team designs category-based carer sharing guided by contextual integrity, protects patient control, adds private prompts against coercion and refines the design with a mixed panel.

Synthetic case. The feature and panel are synthetic; Nissenbaum (2004) and WP248 rev.01 are real.

Errors and limits

Prompts can alert a controlling relative if seen; design their appearance carefully.

Exercises

EX103 — Default notes. Why are consultation notes never shared by default? Rubric: 3 = they carry confidentiality norms; moving them needs the patient's explicit choice;; 2 = mentions confidentiality;; 1 = share all;; 0 = none.
EX104 — Coercion defence. What design responds to coercion by relatives? Rubric: 3 = private prompts when the patient is alone plus clinician questions;; 2 = one part;; 1 = vague;; 0 = none.
EX105 — Who changes settings. Who may change sharing settings? Rubric: 3 = the patient, or a verified legal representative where the patient lacks capacity;; 2 = patient only;; 1 = carer;; 0 = none.

Synthesis

Chapter 35 designs for relationships. Chapter 36 considers scale and differential privacy budgets.

Continue studying — chapter 35 of 50

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →