Implementing Privacy by Design: A Practical Case Study
summary
A case study of a contact-sync contact-discovery feature implemented with on-device hashing to match phone-book entries, using legitimate interest as the legal basis instead of consent and immediately deleting non-matches. It quantifies GDPR exposure (fines up to 4% of turnover or €20M) and describes mitigations: data minimization, purpose limitation, subject-rights interfaces for non-users, default-off contact discovery UI, and deletion processes; it also compares bilateral matching versus simple upload and concludes hashing lowers identifiability but needs UI defaults and deletion to reduce risk.
AI-written summary · about
chapters (12)
- 0:00Welcome
- 3:13GDPR impact
- 7:07Choosing Telegram
- 12:57App data processing
- 17:53Legal grounds
- 22:35Technical protection
- 26:54Purpose limitation
- 30:14Data minimization
- 35:18Privacy by Design
- 38:17Data subject rights
- 43:42Breach notifications
- 45:11Conclusion & Q&A
