Repetition is a key to mastery: "Privacy by Default" principle

The "Privacy by Default" principle means that a person’s privacy is protected from the outset and no additional steps need to be taken to protect personal data, meaning that the customer does not need to manually configure settings or authorise the processing of their data. Complying to this principle ensures that potential breaches in the data acquisition and processing process, as well as risks related to potential data breaches, for instance, leakage of personal data to third parties, are minimised.  

The principle involves minimal data collection from the customer, i.e. only the basic information needed to create an account is required at registration, while at the same time allowing the user to provide additional information as he/she deems necessary. 

Limited data retention is also a feature of this principle, in that the platform automatically anonymises or deletes the user’s data if the account is not used for a certain period of time. Of course, certain period means reasonable amount of time, which shall be assessed on case by case basis. The possibility to store this data for a longer period only available in cases where the user has given his/her consent or there is ongoing investigation or dispute, and in such case retained information, including personal data, may be used as evidence. 

Another feature of the "Privacy by Default" principle is transparency, which provides users with a clear understanding of how their data is collected, used, processed and stored. Users should also be able to manage their privacy settings – specifying what information is shared with other users or third parties, if they are or to be involved in the provision of certain services, content, etc.

Security measures, both technical and organisational, on the part of the businesses are also clearly an important part of compliance with the "Privacy by Default" principle. Examples of security measures include encryption of user data, regular security audits, maintenance and update of systems, as well as trainings of personnel involved in the processing activities.