PRIVACY Logs
Privacy Enhancing Technologies, or PETs, are technical tools and methods that protect personal data by minimizing collection, ensuring confidentiality, and reducing risk.
Privacy Enhancing Technologies are technologies that shape data processing so that data protection is maximiz...
Q Privacy by Design sounds like a good idea. But is it actually a legal requirement? What does the GDP...
GDPR Article 25 makes Privacy by Design and Privacy by Default a binding legal obligation, defining five specific elements that organizations must implement.
The five elements of Article 25:
Data minimization. Collect and process only what's strictly necessary for the stated pur...
Q Is all of this even legal? What does data protection law say about systematically collecting publicl...
OSINT creates personal data through combination, and both the DSGVO and revDSG impose purpose limitation, proportionality, and transparency obligations on anyone who collects it.
Personal data through combination.
This is the crucial legal concept. Even if individual data points...
Q Beyond what's strictly legal, what ethical framework should guide OSINT activities?
OSINT ethics follow a three-zone model: clearly legal and allowed, clearly illegal and forbidden, and a gray zone where context determines appropriateness.
Clearly legal and allowed:
Viewing public social media profiles.
Using Google and other public search engines.
Accessing pu...
Q What is OSINT, and why should privacy professionals care about it?
OSINT, meaning Open Source Intelligence, is the systematic collection and analysis of publicly available information, and its core principle is that "publicly accessible" does not mean "harmless."
* The five-phase intelligence cycle underlying OSINT collection. *
OSINT sits at t...
Q Why are cookies considered technically indispensable, and why are the alternatives limited?
Cookies are essential for session management, e-commerce carts, and personalization; alternatives like Local/Session Storage and IndexedDB exist but have security and scope limitations.
Indispensable functions:
Session management — login & authentication state
E-commerce — shopp...
Q What is browser fingerprinting, and what categories of attributes make a browser uniquely identifiab...
Browser fingerprinting identifies a device by the unique combination of its software, hardware, and configuration — with no cookies or stored state required.
* Attributes that combine into a browser fingerprint. — Laperdrix et al., CC BY 4.0, via Wikimedia Commons. *
Three attri...
Q Why did Google Analytics run into GDPR trouble, and what did the ruling require?
Google Analytics transferred personal data (including IP addresses) to US servers without an adequate legal basis; courts ruled that explicit consent is required and that IP anonymization alone is not sufficient.
The core problem — US data transfer:
Google Analytics sent persona...
Q What technologies enable location tracking, and how accurate can the result be?
Location can be derived from GPS, WiFi triangulation, cell-tower (cellular) positioning, and Bluetooth beacons; combining them yields continuous, meter-accurate tracking.
The main data sources:
Technology
How it locates you
GPS
Satellite positioning; most precise outdoors...
Q PETs sound important in theory. What do they actually look like in practice? What are the main categ...
PETs (Privacy-Enhancing Technologies) fall into three classic categories: data minimization and masking, control and transparency, and anonymous usage.
* The three classic PET categories with examples. *
1. Data Minimization and Masking.
The simplest approach: collect less data...