Privacy by Design and by Default and Data Protection Impact Assessment (DPIA)

Abstract

Get Well Soon’ is a leading pharmaceutical company co-headquartered in Italy and the United Kingdom. Amongst others, ‘Get Well Soon’ focuses on developing smart medical devices many of which can be remotely managed via ad hoc mobile apps. The Head of IT, Davide, is currently developing a new mobile app which links to a smart toothbrush: any data collected via the use of such device is then processed in the backend and shown to users in an intelligible form. Davide has recently completed his mandatory GDPR training. Having learnt that by law privacy shall be baked into any project development lifecycle from the outset, he is now concerned that his new app, as well as any other app developed by his team is not fully compliant with the applicable data protection legislations. As such, he immediately contacts the Global Privacy Team of ‘Get Well Soon’ seeking for advice.