AI
How Privacy Got Its Working Definition
Definitions of privacy stretch from 1890 to today. Warren and Brandeis coined “the right to be let alone” after newspapers started photographing weddings without consent. Every definition since comes from a legal background. The four presenters want one that fits software. Their proposal: a privacy-respecting system enables individuals to maintain agency over their data and the real-world impact from its use, misuse, or abuse. “Agency” beat “ownership” and “control” because a single piece of data can describe multiple people simultaneously.
The Four C’s: Where Privacy Engineering Breaks Down
Four challenge areas shape the project: compliance (doing privacy only to satisfy GDPR auditors), concepts (legal terminology like “differential privacy” doesn’t map to code), context (privacy is both about subjects and subjective), and complexity (a front-end developer can’t see how their data ends up at a third-party processor). The IP address question captures the concept problem cleanly: is an IP address personal information? The answer depends on context, not the specification.
From Legal Requirements to Engineering Checklists
The project plans guidelines for developers, architects, and security practitioners. One concrete deliverable: an ASVS-equivalent for privacy. The right to be forgotten sounds legal, but it has engineering requirements. You need schema-level metadata on every data object, field-to-individual tagging, and a deletion path that covers logs and backups. No metadata schema means no way to find or remove data when a deletion request arrives. Alongside requirements, the project wants pre-built guardrails and building blocks developers can use directly.
Filling the Gaps in CWE and Severity Scoring
CWE, the MITRE common weakness enumeration, has only a small handful of dedicated privacy entries today. The project sees an opening: as CWE expanded from software weaknesses into hardware, adding privacy is the next step. A catalog of privacy-specific weaknesses gives engineers a concrete starting point. Scoring matters alongside enumeration. The project is modeling a privacy severity scorer on CWSS, to rate how badly a weakness hits a system, whether it’s a contained front-end exposure or a flow ending at a third-party processor.
Notable Quotes
All right. We can’t steal it then. Matthew Coles · ▶ 14:07
abuse is intentionally doing wrong. Kim Wuyts · ▶ 8:57
this is a systemic problem Matthew Coles · ▶ 23:00
you get more trust. Kim Wuyts · ▶ 26:04
Key Takeaways
- Privacy needs an engineering definition: agency over data and its real-world impact, not just legal compliance.
- The right to be forgotten requires schema-level metadata tagging and deletion paths that cover logs and backups.
- CWE has almost no dedicated privacy weakness entries; the project aims to fix that with a CWSS-style severity scorer.
About the Speaker(s)
Dr. Kim Wuyts has over 15 years of experience in security and privacy. Before joining PwC Belgium as Manager Cyber & Privacy, she was a senior researcher at KU Leuven, where she led the development and extension of LINDDUN, a widely used privacy threat modeling framework.
Matthew Coles is a Product Security Architect and Technologist with more than 20 years of experience working with business leaders and developers to secure hardware and software systems. He is a technical contributor to OpenSSF and OWASP community standard initiatives.