EPITA Data Privacy by Design Course

• École Pour l'Informatique et les Techniques Avancées – EPITA is running a master's program in May-June 2024.
• The instructor for the "Data Privacy by Design" course is M. Salman Nadeem ([email protected]).
• The class uses a Creative Commons Attribution 4.0 International License.

Course Schedule

• 25/05/2024 (G1) and 01/06/2024 (G2): Introduction and DPbD fundamentals with case studies (3 hours).
• 07/06/2024 (G2, G1): Data privacy risks, Crypto. Package, Data masking (Anonymization vs Pseudonymisation) (3 hours).
• 22/06/2024 (G2, G1): Privacy Enhancing Technologies (PETs), DPbD, and General Data Protection Regulation (GDPR) (3 hours).
• 28/06/2024 (G2, G1): Recap and Conclusion (3 hours).
• 12/07/2024 (G2, G1): Final evaluation (3 hours). Total course duration is 15 hours.

Grading Criteria

• Class participation (attendance & reactivity): 10%.
• Class activities (quizzes): 30%.
• Final project (individual report & group presentation): 60%.

Notes & Collaboration

• The course uses a MS Teams Channel called 'Data Privacy by Design – Spring 2024' for collaboration, using the code 'jp6i9h1'.
• The channel publishes announcements, provides course slides/material, and manages assignments/projects.
• A course mindmap is available for better organization and refreshing of course topics.

Lecture 1 Outline

• Data & its types.
• Data privacy.
• Data Privacy by Design (PbD) principles.
• Data PbD goal, strategies & methodology.
• Case study.
• Quiz.
• The course involves threat modeling, data masking, GDPR compliance, and a final project.

Data

• Data are facts and statistics collected for reference or analysis (Oxford dictionary definition).
• Data is all around us.
• Data transforms into Information, Knowledge, and Wisdom, depicted in the DIKW pyramid.

Types of Data

• Qualitative data: Description referring to the quality of something.
• Quantitative data: Description in numbers.
• Categorical data: Categories or groups without inherent order.
• Discrete data: Distinct, separate values (e.g., count of items).
• Continuous data: Any value within a range (e.g., measurements).

Unstructured vs Structured Data

• Unstructured data is easy for humans to understand but not for machines, lacking a fixed underlying structure.
• PDFs and scanned images are examples of unstructured data.
• Structured data is machine-readable: CSV format is an example
• There are many more formats out there that are structured and machine readable e.g., https://opendatahandbook.org/guide/en/appendices/file-formats
• JSON is another example of a structured data format

Data Privacy Definitions

• Data privacy is the claim of individuals to determine when, how, and to what extent their information is communicated to others (Westin, 1970).
• "Privacy as contextual integrity" involves appropriate information flows conforming with contextual information norms (Nissembaum, 2004).
• Legal frameworks include GDPR (transparency, purpose, proportionality, accountability) and ECHR Art 8 (respect for private and family life).

Privacy by Design (PbD) Principles

• Proactive not Reactive; Preventive not remedial.
• Privacy as the default setting.
• Privacy Embedded into Design.
• Full functionality – Positive-Sum, not Zero-sum.
• End-to-end security – Full lifecycle protection.
• Visibility and transparency – keep it open.
• Respect for user privacy – keep it user-centric.

An Obligation

• Users expect transparency regarding the use and access of their data, handled with care and security.
• Organizations need to cover both LAW requirements and USERS' expectations
• GDPR Article 25 mandates data protection by design and by default.

Data Privacy by Design & by Default

• Minimizing privacy risks and trust assumptions placed on other entities/parties.
• Six strategies: Minimize Collection, Minimize Disclosure, Minimize Linkability, Minimize Centralization, Minimize Replication, Minimize Retention.

LINDDUN

• LINDDUN (https://linddun.org/) is a systematic threat assessment methodology.
• The threat analysis process includes modeling the system, eliciting threats, and managing threats.

LINDDUN Threat Categories

• Linkability: The ability to link pieces of information related to an individual.
• Identifiability: The ability to identify an individual from a dataset.
• Non-repudiation: Ensuring actions or transactions cannot be denied.
• Detectability: The possibility to detect the presence of data or actions.
• Disclosure of information: Accidental or unintended release of sensitive information.
• Unawareness: Lack of awareness regarding the rights of individuals or the availability/sensitivity of data.
• Non-compliance: Failing to comply with data privacy regulations.

Case study 1: Electricity Smart Metering System

• Smart energy meters record household consumption every 30 minutes.
• Privacy Risks involves inferences of sensitive personal attributes.
• Requirements: accurate billing, aggregate statistics, and fraud/tampering detection.

Case Study 1 Iterations

• Starting assumptions: Functionality defined.
• Explicit activities: Actionable steps.
• Use an agile approach with multiple iterations.

Electricity Smart Metering

• The user domain elements are trusted.
• The service domain is non-trusted.

Data Identification

• User domain: Personal, billing, and consumption data.
• Service domain: Personal, billing, consumption, and transaction logs.

Data Distribution Analysis

• Electricity smart metering system data distribution exists in domains.

Threat Modeling & the Data Lifecycle

• A strategy to evaluate systematically thinking about negative scenarios.
• Techniques like STRIDE, STRIPED, and LINDDUN are used.
• Risk analysis uses a likelihood vs. impact assessment.

Technological Solutions

• Address main threats/risks: Keep data out of service domain, use transport encryption, process data with obfuscation, enhance privacy technologies.
• Apply the six strategies (minimize collection, disclosure, linkability, centralization, replication, and retention).

Methodology Freedom

• No fixed methodology is prescribed.
• Take privacy considerations and perform risk management.
• Assert data subject rights and integrate appropriate controls.
• Focus on raising transparency of service/product.

Project Kick-off

• Form groups (3-5 members)
• Select project
• The Individual report includes: dataset explanation, creation of system reference diagram, perform threat modeling using LINDDUN categories.
• The deadline to complete the assignment should be found on Teams "Assignment section"