6 The Privacy Review Process: Privacy with a Technical Lens

In earlier chapters of this book, we have seen how the modern development process empowers engineers to build products without the constraints of process. Adding to this innovative spirit is the flow of data and the possibilities and risks inherent therein. Add in impatient business leaders, complicated regulators and a skeptical customer base, and you have a realistic possibility of products shipping that have privacy issues.

The privacy review process is aimed at ensuring that privacy risks are addressed before a company releases products or features. Since the engineers who build the products do not always appreciate and/or have the time to understand the privacy implications of their work, it is vital that there be a process to ensure scrutiny for these products from a privacy lens.

Having a privacy review process is a continuation of the work we have discussed so far, whereby a company has to manage how it classifies data, catalogs the data, protects it using access controls, and processes and shares it over the course of conducting business.

6.1       What are “Privacy Reviews”?

6.1.1   The Privacy Impact Assessment (PIA)

6.1.2   How to conduct the Data Protection Impact Assessment (DPIA)

6.2       How Do You Operationalize The Privacy Review Process?

6.3       Making the case for a Technical Privacy Review

6.3.1   Timing and Scope

6.3.2   What the Technical Review covers that the Legal Review does not

6.4       Integrating Technical Privacy Reviews into the Innovation Pipeline

6.5       Scaling the Technical Privacy Review Process

6.5.1   Data Sharing

6.5.2   Machine Learning Models

6.6       Sample Technical Privacy Reviews

6.6.1   Messaging Apps and Engagement Apps - do they connect?

6.6.2   Masks and Contact Tracing

6.7       Summary