RE: "Software Engineering" as scope limitation?

["Dr. Ann Cavoukian" <Commissioner.IPC@ipc.on.ca>]

Dennis,

Thanks for your thoughts re: software vs systems engineering. I agree that a common understanding of both definitions and scope is essential to Committee progress. This may take some work -and input from expert practitioners such as you is very helpful getting us there.

As discussed at the inaugural meeting yesterday, the output of the Committee should be relevant to many different constituencies and stakeholders. This is consistent with Privacy by Design's goal to serve as a comprehensive set of privacy principles of universal application. PbD principles should be applied early, systematically and in a holistic, interdisciplinary way so that engineers of all stripes can understand and apply them in a consistent manner, thereby embedding privacy directly into the information systems that they build.

There are both substantive and process-related elements to Privacy by Design. I like to draw from my experience with Privacy Impact Assessment (PIAs), a Privacy by Design-consistent project management framework pioneered and used by the Ontario government since the 1990s. In brief, PIAs seek to embed privacy principles directly into the operation of information systems by documenting privacy risks and mitigation measures in a systematic way, from conceptual, through logical, to physical design stages of a project. In this way, a well-executed PIA bridges and unites all of the stakeholders and participants in a given project.

My hope is that we can build upon world-class project design and documentation methodologies, such as PIAs, in this new OASIS Committee and create a world-class standard with broad appeal and utility for engineers of all types.

- Ann