Chapter 38 — Privacy and data protection: validation
Lesson map
Lesson 38 published. Map, example, EX112.
flowchart TD
N0["Learning outcomes"]
N1["38.1 Verification and validation"]
N2["38.2 Usability of privacy"]
N3["38.3 Legal validation"]
N4["38.4 Validating with the supervisory context"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX112"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["38.1 Verification and validation"]
N2["38.2 Usability of privacy"]
N3["38.3 Legal validation"]
N4["38.4 Validating with the supervisory context"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX112"]
[Learning outcomes]
|
v
[38.1 Verification and validation]
|
v
[38.2 Usability of privacy]
|
v
[38.3 Legal validation]
|
v
[38.4 Validating with the supervisory context]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX112]
Learning outcomes
You will (1) distinguish verification from validation; (2) validate privacy features with patients; (3) validate legal assumptions with experts.
38.1 Verification and validation
Verification asks whether the system meets its requirements; validation asks whether the requirements meet real needs. Zara's tests verified that erasure reaches every store. Validation asks whether patients understand erasure and get what they expect. She interviews twelve synthetic-scenario participants, volunteers who use test accounts. Several expect erasure to remove their medical record entirely, which health law does not allow. The validation reveals a gap in explanation, not in engineering, and leads to clearer wording in the erasure screen. Patients tested the new screen.
38.2 Usability of privacy
Zara runs usability tests of the privacy dashboard. Participants try to find who has seen their record, change sharing settings and download their data. Most succeed, but finding the access history takes too long. She moves it to the dashboard's first screen. She measures task time before and after and reports the improvement. Privacy controls that people cannot find or use, she explains, provide little real protection, and transparency obligations in Article 12 imply that people must actually be able to use what is offered.
38.3 Legal validation
Zara's designs rest on legal assumptions: that portability excludes clinicians' notes, that the laboratory partner is a separate controller, that retention of medical records overrides erasure. She asks Pellmore's counsel to validate each assumption and record the reasoning. Counsel confirms most but refines one: some patient-entered symptom notes are part of the medical record and must be retained, so erasure must exclude them. Zara updates the erasure requirements. She learns that legal assumptions should be validated explicitly, not inherited from earlier projects.
38.4 Validating with the supervisory context
Zara also reviews published decisions and guidance from supervisory authorities on telemedicine, to check that Pellmore's approach is consistent with how regulators interpret the law. She records relevant guidance in a short brief for the data protection officer. She does not treat any single decision as binding for Pellmore, but she uses them to identify risks the team had not considered, such as the treatment of video recordings. Validation, she concludes, looks outward to people, lawyers and regulators, while verification looks inward to requirements.
Worked example
Zara validates erasure expectations with participants, improves access-history usability, has counsel validate legal assumptions (refining symptom-note retention) and briefs the DPO on regulatory guidance.
Synthetic case. Participants and counsel are synthetic; GDPR Article 12 is real.
Errors and limits
Small validation groups may not represent all patients; recruit diverse participants.
Exercises
- EX112 — V and V. Distinguish verification from validation. Rubric: 3 = verification checks requirements are met; validation checks requirements meet real needs;; 2 = one;; 1 = confuses;; 0 = none.
- EX113 — Erasure expectation. What did validation reveal about erasure? Rubric: 3 = patients expected full medical record removal, which law prevents; explanation needed;; 2 = mentions expectation;; 1 = vague;; 0 = none.
- EX114 — Refined assumption. Which legal assumption did counsel refine? Rubric: 3 = some patient-entered symptom notes are part of the medical record and must be kept;; 2 = mentions notes;; 1 = vague;; 0 = none.
Synthesis
Chapter 38 validates outward. Chapter 39 keeps the system maintainable.
Continue studying — chapter 38 of 50
← Chapter 37 (draft) · Course chapter index · Chapter 39 (draft) →