Introduction
Privacy engineering is often associated with terms such as:
— privacy-by-design and privacy-by-default, coined by Ann Cavoukian[16] in the early nineties; or
— data protection by design and data protection by default, used in the European regulation published in April 2016[17].
In recent years, a number of concepts, principles and approaches have been proposed for privacy engineering. In a paper on privacy engineering[20], Spiekermann and Cranor contrast privacy-by-architecture from privacy-by-policy. The former focuses on data minimization, anonymization and client-side data processing and storage while the latter focuses on enforcing policies in data processing. In a paper on engineering privacy-by-design[21], Gürses, Troncoso, and Diaz state that data minimization should be the foundational principle for engineering privacy-respecting systems. In a paper on privacy-by-design in intelligent transport systems[22], Kung, Freytag and Kargl define three principles, minimization, enforcement and transparency. In a paper on protection goals for privacy engineering[23], Hansen, Jensen, and Rost identify three goals: unlinkability, transparency and intervenability. In two papers on privacy design strategies[29][30], Hoepman identifies four data oriented strategies (minimize, separate, abstract, hide), as well as four process oriented strategies (inform, control, enforce, demonstrate).
https://www.iso.org/obp/ui/#iso:std:iso-iec:tr:27550:ed-1:v1:en