Privacy by Design for Web
Developers
Building Trust through Responsible Development

January 24, 2024

by Miguel Villegas
iSecurePrivacy LLC
Mike.Villegas@isecureprivacy.com
213-453-6174

Abstract
In today's digital landscape, the protection of user privacy has become aparamount concern. As web developers, it is our responsibility to ensure thatthe websites and applications we create not only deliver exceptional user
experiences but also prioritize the privacy and security of user data. This lecture,"Privacy by Design for Web Developers," explores the foundational principles
and practical strategies that empower web developers to integrate privacy into
every facet of their work.
In this lecture, we will delve into the concept of Privacy by Design (PbD) and its
significance in the context of web development. We will examine how PbD
serves as a proactive approach to safeguarding user data, fostering trust, andcomplying with evolving privacy regulations such as the GDPR and CCPA/CPRA.

• Miguel (Mike) O. Villegas
CISA, CISSP, CSX|F, CSX|A, CDPSE, CEH,
ISO/IEC 27001 Lead Implementer• vCISO for TRISTAR Insurance GroupLong Beach, CA• CTO for Xahive
Toronto, Canada• Mike.Villegas@isecureprivacy.com• 213.453.6174 (mobile)3

Agenda• Privacy by Design• The 7 Foundational Principles of PbD• US Privacy Laws
• Use CCPA/CPRA as Sample Privacy Rules• Privacy Impact Assessment• Privacy Policy• Incorporate Privacy Into SDLC
• PCI Secure Software Framework• Summary
CCPA Link: https://www.oag.ca.gov/privacy/ccpa

4Introduction

1

Definition ofPrivacy by
Design (PbD)

Privacy by Design (PbD) is anapproach to embedding
privacy and data protection
measures into the designand development ofsystems, processes, andtechnologies from theoutset, rather than as anafterthought.

2

Importance ofPrivacy in Web
Development

With the increasing focus ondata privacy and security,
integrating privacy features
in web development is
crucial to building user trustand compliance withregulations.

3

Agenda for the
Presentation

This presentation will cover
key concepts, principles, andbest practices of Privacy by
Design, aiming to equip web
developers with theknowledge to build privacyfocused solutions.

What is Privacy by Design (PbD)?
1

Concept originatedby Dr. Ann Cavoukian

2

Proactive approachto privacy

3

Embedding privacy
into design

Privacy by Design was

Privacy by Design

It emphasizes theconceptualized by Dr. Ann

advocates a proactive

integration of privacy into

Cavoukian as an approachstance, emphasizing thethe design of systems,

to proactively embedding

importance of anticipating

aiming to ensure thatprivacy into the design andand preventing privacy

privacy considerations arearchitecture of systems,

breaches, rather thancore components of thepromoting a privacy-

reacting to data protection

architecture from therespecting and data-

issues after they haveoutset.

protective mindset.

occurred.

The 7 Foundational Principles of PbD

Proactive not Reactive
Anticipate and prevent
privacy breaches.

Privacy as theDefault Setting

Privacy Embedded
into Design

Ensure that privacy isthe default setting foruser data.

Integrate privacy into
the system from theoutset.

End-to-End Security– Lifecycle
Protection
Ensure that all data issecurely managed
throughout its lifecycle.

Visibility andTransparency
Keep users informed
about privacy practices
and ensuretransparency.

Full Functionality –Positive-Sum, not
Zero-Sum
Seek to satisfy all
legitimate interests andobjectives in a win-win
manner.

Respect for User
Privacy – Keep it
User-Centric
Empower user privacy
through user-friendly
options and controls.

Legal and Regulatory Compliance1

Overview of relevant
privacy laws
Understanding and2

Importance ofaligning with legal
requirements

3

Reducing legal risks
through PbD
Privacy by Design serves asadhering to privacy laws

Aligning developmenta proactive strategy forsuch as GDPR and CCPA ispractices with legal

reducing legal risks

essential for ensuring legal

standards demonstrates a

associated with data

compliance andcommitment to data

privacy non-compliance,

minimizing the risk of legal

privacy and protection,

safeguarding both users'

repercussions.

contributing to trust andrights and thecredibility.

organization's reputation.

US Privacy Laws
•
•

•
•
•
•

Currently, there is no single data protection legislation in the United Statesof America.
However, California, Colorado, Connecticut, Utah, Virginia, and 10 otherstates (14) have each enacted comprehensive consumer data protection
laws.
In California, the California Consumer Privacy Act (CCPA) was signed into
law in 2018 and came into force in January 2020.
There are 21 states that do not have a statewide privacy law.
The California Privacy Rights Act (CPRA) was passed in November 2020
and amended the CCPA.
The provisions set forth under the CPRA came into force on January 1,
2023.
CCPA Link: https://www.oag.ca.gov/privacy/ccpa9https://iapp.org/media/pdf/resource_center/State_Comp_Privacy_Law_Chart.pdf

10https://iapp.org/resources/article/us-state-privacy-legislation-tracker/

11

CCPA
The California Consumer Privacy Act (CCPA) of 2018 is a state statuteintended to enhance privacy rights and consumer protection for residents ofCalifornia, United States.

Right toKnow

Right toDeleteRight to
Opt-Out

CCPA Link: https://www.oag.ca.gov/privacy/ccpa

Right toNonDiscrimination

12

CCPA

Right toKnow

The right to know – you can request businesses todisclose• PII that is collected about you• Sources where PII is collected• Purpose the business uses PII• With whom the business discloses PII• What PII the business sells or discloses tothird-parties
CCPA Link: https://www.oag.ca.gov/privacy/ccpa

13

CCPA

Right toDeleteThe right to delete – You can request thatbusinesses delete personal information• That the business collects from you• The business tells service providers to do
the same• This right to delete is subject to certain
exceptions (such as if the business islegally required to keep the information).
CCPA Link: https://www.oag.ca.gov/privacy/ccpa

14

CCPA

Right to
Opt-Out

The right to opt-out – you may request thatbusinesses• Stop selling or sharing your personal
information (“opt-out”)• Including via a user-enabled global privacy
control.
• Businesses cannot sell or share yourpersonal information after they receive
your opt-out request unless you later
authorize them to do so again.
CCPA Link: https://www.oag.ca.gov/privacy/ccpa

15

CCPA
Right toNonDiscrimination

The right to non-discrimination for exercising
their CCPA rights– you may request thatbusinesses• Cannot deny goods or services,• Charge you a different price, or• Provide a different level or quality of goods
or services just because you exercised yourrights under the CCPA.
CCPA Link: https://www.oag.ca.gov/privacy/ccpa

16

CCPA – Additional Business Obligations• Provide notice to consumers at or before data collection.
• Create procedures to respond to requests from consumers to opt-out,
know, and delete.
• For requests to opt-out, businesses must provide a “Do Not Sell My Info”
link on their website or mobile app.
• Respond to requests from consumers to know, delete, and opt-out within
specific timeframes.
• As proposed by the draft regulations, businesses must treat userenabled privacy settings that signal a consumer’s choice to opt-out as avalidly submitted opt-out request.
• Verify the identity of consumers who make requests to know and to delete,
whether or not the consumer maintains a password-protected account withthe business.
CCPA Link: https://www.oag.ca.gov/privacy/ccpa

17

CCPA – Additional Proposed Business Obligations• Disclose financial incentives offered in exchange for the retention
or sale of a consumer’s personal information• Explain how they calculate the value of the personal
information.
• Businesses must maintain records of requests and how they
responded for 24 months in order to demonstrate their compliance.
• Businesses that collect, buy, or sell the personal information of
more than 4 million consumers have additional recordkeeping and training obligations.

CCPA Link: https://www.oag.ca.gov/privacy/ccpa

18

Privacy Impact Assessment (PIA)
1

Definition of PIA
Privacy Impact Assessment(PIA) is a process used to2

Conducting a PIA forweb development
projects

3

Identifying andmitigating privacy
risks

identify, assess, andDevelopers can leverage

PIA facilitates the

mitigate the privacy risks

PIA to systematically

identification of potentialof a proposed project,evaluate the potential

privacy risks and thesystem, or technology,

privacy impacts of web

implementation of

ensuring that privacy

development projects,

measures to mitigate these

considerations are

addressing privacy risks

risks, reinforcing privacy-

integrated at the earlyand enhancing overall

by-design practices.

stages of development.

compliance.

CCPA/CPRA Opt-Out
Opt-in consent for consumers under 16

Parental consent for consumers under 13

Provide at least two methods for requests
Websites must include link to “Do Not Sell My Personal
Information”

A business does notneed to provide a noticeof right to opt-out if:
1) It does not sell
personal information;and2) It states in its privacy
policy that it does notsell personal
information

Websites must include "Limit the Use of My Sensitive Personal
Information” link

https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-add-adm.pdf

20

COOKIES
When you visit some web pages, you are
given the option to set a cookie when you
click another link. The cookie contains
information about how the cookie works.
There are several types of cookies:• Session Cookies• Persistent Cookies• Authentication Cookies• Tracking Cookies• First-Party Cookies• Third-Party Cookies• Zombie Cookies• Essential Cookies

21CPPA Proposes Requiring Browsers to Offer Opt-Out Signals
The California Privacy Protection Agency Board voted 5-0 at its December 8,2023, meeting to advance a legislative proposal to require browser vendors toinclude a feature that allows users to exercise their California privacy rights
through opt-out preference signals.
• CPPA Board voted 5-0 to advance proposal• Would require browser vendors to include opt-out preference signals• Signals allow consumers to easily opt-out of data sale/sharing• Only 10% of browsers currently support signals• Proposal aims to make it easier for consumers to exercise privacy rights• CA would be first state to mandate if passed into law

https://cppa.ca.gov/announcements/2023/20231211.html

22

SAMPLE23

CPRA
In November of 2020, California voters approved Proposition 24, the CPRA,
which amended the CCPA and added new additional privacy protections thatbegan on January 1, 2023. As of January 1, 2023, consumers have new rights
in addition to those above, such as:

Right toCorrect

Right toLimit

CCPA Link: https://www.oag.ca.gov/privacy/ccpa

24

CPRA

Right toCorrect

The right to correct – You may ask businesses tocorrect inaccurate information that they haveabout you.
The California Privacy Protection Agency iscurrently engaged in a formal rulemaking
process and has proposed CCPA regulations
pertaining to the right to correct, but these are
not currently final or effective.
CCPA Link: https://www.oag.ca.gov/privacy/ccpa

25

CPRA

Right toLimit

The right to limit the use and disclosure ofsensitive personal information collected about
them. You can direct businesses to• Only use your sensitive personal
information for limited purposes• For example, your social security number,financial account information, yourprecise geolocation data, or your genetic
data for limited purposes, such asproviding you with the services you
requested.
CCPA Link: https://www.oag.ca.gov/privacy/ccpa

26

Privacy Impact Assessment (PIA)••

Categories
•
•
•
•
•

Employee Data
Customer Data
Patient Data
Suppliers/Vendors
Company Information•••

Identifiers such as a real
name, alias, postal
address, uniquepersonal identifier,online identifier,Internet Protocol
address, email address,
account name, social
security number, driver’s
license number,passport number, orother similar identifiers.
Characteristics ofprotected classifications
under California orfederal law.
Biometric information.
Professional or
employment-related
information.

•

Personal Information

Commercial
information, including
records of personal
property, products orservices purchased,
obtained, orconsidered, or otherpurchasing or
consuming histories ortendencies.
Internet or otherelectronic network
activity information,
including, but notlimited to, browsing
history, search history,
and information
regarding a
consumer’sinteraction with aninternet website
application, or
advertisement.

•
•

•

•

•

Geolocation data.
Audio, electronic,
visual, thermal,
olfactory, or similar
information.
Education
information, defined
as information that is
not publicly available
Inferences drawn fromany of the information
identified to create aprofile about aconsumer reflecting
the consumer’s
preferences,characteristics,
psychological trends,
predispositions,behavior, attitudes,
intelligence, abilities,
and aptitudes.
Sensitive personal
information.”

Privacy Impact Assessment (PIA)
•
•
•
•
•

•
•
•
•
•
•
•
•
•
•

Data Inventory

Data – describe the data
Source – where does it come from or generated
Location/Where Stored
Were has data been sent?
Technology Used (Is the data located on:• (1) database (e.g., MS SQL, Oracle, MySQL, Postgres, etc)
• (2) server (e.g., Windows, Linux, HP/UX)• (3) file share (Sharepoint, Windows, Google Docs, Box,etc),• (4) mobile device (e.g., laptops, smartphones, tablets),• (5) applications (e.g., Excel, MS Access),• (6) cloud services (e.g., AWS, Azure, Google Apps, Office 365)
Data Purpose
Consent of Data Subjects?
Retention Requirements
Parties with Access to Data
Security Measures to Protect Data
Destruction – how is it destroyed?
Contact information of the Data Controller, Data Processor, and Data Protection Officer
Classification / Sensitivity
Business Criticality
Comments

SCOPE OF DATA

Critical Risk Data (CRD)

29

PIA is a valuable tool for organizations to implement PbD
principles.

Using the PIA• Typically, the PIA is done by the Privacy Officer, CISO, orInternal Audit• PIA is sent to each critical business unit and backofficegroup in the enterprise• An aggregated PIA is consolidated to see where critical
data resides• Provide input on the PIA process.
• Use the PIA to determine where critical data resides• Perform an inventory of your own for data that you will beusing in your development process• If it is critical risk data (CRD), provide your list to the CPO,
CISO, or Audit to ensure it is included in the updated
Annual PIA.

Sensitive Data
All sensitive data stored, processed, or transmitted by the software is identified.
•

all payment data (PII, ePHI, PCI, critical risk data)•authentication credentials (passwords, tokens, certificates, DEKs, KEKs)•

cryptographic keys and related data (such as IVs and seed data for random number generators);•

system configuration data such as:

•

•

•

registry entries,•

platform environment variables,•

prompts for plaintext data in software allowing for the entry of PIN data, or configuration
scripts.

Where is it stored•

Temporary storage (volatile memory)•Semi-permanent storage (RAM)•Non-volatile storage (flash drives and flash storage media)

How is it protected•

Cryptography

•

ACL.

•

Protected memory.

• HSM
31

Web Software Components and Services
Modern software is rarely created entirely in-house and is typically composed of various bespoke
code segments that are integrated with numerous components. The following software
components need to be identified, verified, and tested for vulnerabilities:• All proprietary software libraries, packages, modules, and/or code packaged in a manner thatenables them to be tracked as a freestanding unit of software.
• All third-party and open-source frameworks, libraries, and code embedded in or used by thesoftware during operation.
• All third-party software dependencies, APIs, and services called by the software during
operation.
NIST refers to “provenance data” as information of the above components and services,
versions, and any third-party code that may be embedded in these components.

32

The software does not disclose sensitive data through unintended channels.
•

Error messages, error logs, or memory dumps.

•

Execution environments that may be vulnerable to remote side-channel attacks to expose sensitive data•

Automatic storage or exposure of sensitive data by the underlying execution environment, such as
through swap-files, system error logging, keyboard spelling, and auto-correct features•

Sensors or services provided by the execution environment that may be used to extract or leak sensitive
data such as through use of an accelerometer to capture input of a passphrase to be used as a seed for acryptographic key, or through capture of sensitive data through use of cameras, near-field communication(NFC) interfaces

33

Data Minimization and Purpose Limitation
Collecting only necessarydataDefining the purpose ofdata processed

Limiting data collection

Developers should limit the

A clear definition of the purpose

supports the principle of Privacy

collection of personal data toof data processing enables

by Design, ensuring that only

what is strictly necessary for thetransparent and lawful data

essential data is collected,

intended purpose, reducing thehandling, aligning with theprocessed, and retained,volume of collected data, andprinciple of purpose limitation

thereby enhancing user privacy

minimizing privacy risks.

within Privacy by Design.

and trust.

IF YOU DO NOT NEED IT
DO NOT STORE IT

Emphasizing data minimization

CCPA/CPRA Cybersecurity Audit§ 7123. Scope of Cybersecurity Audits.
• Title of qualified individuals responsible forbusiness’s cybersecurity program• Date the cybersecurity program evaluation
presented to BOD• Safeguards• Authentication such as MFA, strong uniquepasswords or passphrases• Strong encryption of PII at rest and in transit• Zero trust architecture• Account management and access controls(RBAC)• Employee, contractor, other personnel• Service provider restricted access• Privileges to third parties to whom thebusiness sells or shares PII

•
•
•
•
•
•
•
•
•
•
•
•

Restrict number of privileged accounts
Inventory of PII, hardware, software, andapproval process
Patching and change management
Secure hardware and software configuration
standards
Vulnerability management (scans, pen tests,
network monitoring)
AV/Anti-Malware
Segmentation controls
Cybersecurity awareness, education, andtraining
Secure development and secure coding
Oversight of service providers/vendors
Retention requirements
Incident Response

https://cppa.ca.gov/meetings/materials/20230908.html

35

California Governor Approves "Delete Act" to Strengthen Data Privacy• Governor Newsom signed "California Delete Act" (SB 362) into law• Gives CPPA authority over state's data broker registry• Requires accessible deletion system for consumers by January 1, 2026
• Allows consumers to direct data brokers to delete info in one step
• Prohibits data brokers from selling/sharing deleted info
• Expands CCPA's definition of sensitive personal information• Strengthens protections for reproductive privacy• Goes into effect January 1, 2024
• By January 1, 2028, data brokers required to have independent compliance audit• Penalty of $200 administrative fine per day for non-compliancehttps://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202120220SB362

36

User Consent and Control
1

Importance of obtaining informed consent
Ensuring that users provide informed consent for data collection and processing activities,
respecting their autonomy and privacy preferences as fundamental components ofPrivacy by Design.

2

Providing users with control
Empowering users with control over their personal data, including the ability to access,review, and manage their data, fostering trust and transparency within Privacy by Design.

3

Clear and user-friendly consent mechanisms
Implementing transparent and easily accessible consent mechanisms allows users tomake informed choices, honoring the user-centric principle of Privacy by Design.

Privacy-Focused Development Tools andFrameworks
Overview of tools andframeworks

Incorporating privacy
features

ExamplesExisting development tools

Integrating privacy-focusedand secure coding practices

and frameworks prioritize

tools and frameworks into

exemplify the initiative to

privacy elements, offeringdevelopment environments

incorporate privacy-centric

developers the resources tofacilitates the cultivation ofdevelopments into web

integrate privacy-enhancing

privacy-aware applications

development processes.

features into their solutions.

and systems.

Privacy-preserving libraries

Privacy Training for Developers
Importance of privacy awarenessInducting developers with a comprehensive
understanding of privacy principles and bestpractices enriches their ability to design anddevelop privacy-respecting solutions.

Incorporating privacy training

Integrating privacy education into developer
onboarding processes illuminates thesignificance of privacy by design in theorganization's ethos and operational
standards.

Continuous education and updates

Maintaining ongoing education and updates
on privacy best practices ensures thatdevelopers remain adept at evolving privacy
requirements and industry standards.

Privacy Testing and Auditing
Integration into the development lifecycle
Regular privacy audits
Tools and methodologies

OWASP SAMM v2.0

The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate
and implement a strategy for software security that is tailored to the specific risks facing the organization.

Software Development Life Cycle (SDLC)
Stage 1: Plan and brainstorm.
Stage 2: Analyze requirements.

If you have 1 hour tochop down a tree,
you should spend 45
minutes sharpening
your ax

Stage 3: Design the mockups.
Stage 4: Develop the code.
Stage 5: Test the product.
Stage 6: Implement and launch the product.

Privacy andCybersecurity

Stage 7: Set up maintenance and operations.

43

Incorporate Privacy into SDLC
Requirements Analysis
DesignImplementation

Testing

Deployment

Maintenance and Updates

Identify privacy requirements for the application, considering factors such as datacollection, storage, processing, data traversal, sharing, and destruction
Develop application designs that prioritize privacy, incorporating featuers such asdata minimization, encryption, access controls, and secure data storage. Use
industry-accepted encryption algorithms.
Ensure that privacy-enhancing technologies and best practices are employedduring the development process, including secure coding techniques, privacypreserving algorithms, and secure data transmission protocols.
Conduct thorough privacy testing, including vulnerability assessments, fuzzy
testing, penetration testing, static and dynamic code analysis scans, OWASP Top 10,
CWE
Implement privacy controls and monitoring systems to ensure that the applicaion
maintains compliance with data protection regulations and adheres to privacy bestpractices throughout its lifecycle.
Regularly review and update the application to address emerging privacy risks andregulatory changes, ensuring that privacy remains a core consideration throughout
the application's lifecycle.

PCI Secure Software Framework (SSF)
Secure SLC Control Objectives

Secure Software Control Objectives

CO1: Security Responsibilities and Resources

CO1: Critical Asset Identification

CO2: Software Security Policy & Strategy

CO2: Secure Defaults

CO3: Threat Identification & Mitigation

CO3: Sensitive Data Retention

CO4: Vulnerability Detection & Mitigation

CO4: Critical Asset Protection

CO5: Change Management

CO5: Authentication & Access Control

CO6: Software Integrity Protection

CO6: Sensitive Data Protection

CO7: Sensitive Data Protection

CO7: Use of Cryptography

CO8: Vendor Security Guidance

CO8: Activity Tracking

CO9: Stakeholder Communications

CO9: Attack Detection

CO10: Software Update Information

CO10: Threat & Vulnerability Management
CO11: Secure Software Updates
CO12: Software Vendor Implementation Guidancehttps://docs-prv.pcisecuritystandards.org/Software%20Security/Supporting%20Document/PCI-Secure-Software-Program-Guide-v1_2.pdf

PCI Account Data
Account Data
Cardholder Data includes:

Sensitive Authentication Data includes:•

Primary Account Number (PAN)•

Full track data (magnetic-stripe data or equivalent ona chip)•Cardholder Name•

CAV2/CVC2/CVV2/CID•

Expiration Date•

PINs/PIN blocks•

Service CodePAN Obfuscation•

Encryption

Implies it can be decrypted•

Truncation

1234-56**-****-7890 (first 6; last 4)•

Hashing

One way hashing with salt; need strong algorithm not subject to rainbow•

Tokenization

Data replaced by surrogate, proxy values or tokens•

Masking

Data displayed in viewing or entering (first 6; last 4)

The 7 Foundational Principles of PbD

Proactive not Reactive
Anticipate and prevent
privacy breaches.

Privacy as theDefault Setting

Privacy Embedded
into Design

Ensure that privacy isthe default setting foruser data.

Integrate privacy into
the system from theoutset.

End-to-End Security– Lifecycle
Protection
Ensure that all data issecurely managed
throughout its lifecycle.

Visibility andTransparency
Keep users informed
about privacy practices
and ensuretransparency.

Full Functionality –Positive-Sum, not
Zero-Sum
Seek to satisfy all
legitimate interests andobjectives in a win-win
manner.

Respect for User
Privacy – Keep it
User-Centric
Empower user privacy
through user-friendly
options and controls.

THANK YOU!