NIST Privacy Framework, Govern-PGV.PO-P2

Implement data protection by design and by default in every processing tool and process, and appoint a data protection officer where processing is carried out by a public authority, requires regular and systematic large scale monitoring of data subjects, or involves large scale processing of sensitive data or criminal records.

Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than fifty workers and none of the high-risk, non-occasional or special-category exceptions apply, and block rather than delete personal data pending any liability claim when you rectify or erase it.

Build data protection into the design of your processing and make it the default, and keep records of your processing activities.

Implement data protection by design and by default, including pseudonymization and data minimization, so that only the personal data necessary to each specific purpose is processed by default.

Implement appropriate technical and organisational measures, including data protection by design and by default, to secure personal data at a level appropriate to the risk and to be able to demonstrate compliance with the Act.

Apply appropriate technical and organizational measures, such as pseudonymization, both when you determine the means of processing and when you process personal data, so that the data protection principles such as minimization are implemented effectively and the processing protects data subjects' rights (Article 26(1)).

Apply measures that ensure, by default, that you process only the personal data necessary for each specific purpose, as to the amount collected, the extent of processing, the storage period and accessibility (Article 26(2)).

A data controller or processor must implement personal data protection by design and by default, and must secure personal data with technical and organizational measures against unauthorized access, collection, use, disclosure, copying, modification, or destruction, and against the loss of any storage medium on which it is held.

Build data protection into the processing by design and by default, including pseudonymization, and process by default only the personal data necessary for each specific purpose.

Build data protection into the design and the default settings of your processing, restrict processing to persons acting under your authority and on your instructions, and take the measures necessary to secure personal data against loss, alteration, or unauthorized access, having regard to its nature and the risks the processing presents.

Secure personal data with the technical and organisational measures articles 37 to 41 require, determined from a risk, threat and vulnerability analysis, and build data protection into the design of your processing and make it the default.

Configure all default privacy settings provided to children to settings that offer a high level of privacy.

Configure default settings for high privacy and safety.

A provider of an online social networking service, video-sharing platform service, online game, AI companion, general conversational chatbot or software application store would have to ensure a high level of privacy, safety and security of minors and design its service by default to the Chapter III requirements, departing from them only after establishing through age assurance that the user is an adult.

Take appropriate and proportionate measures to ensure a high level of privacy, safety and protection of children and teenagers within the service, the duty of Article 28(1) of Regulation (EU) 2022/2065 that Section 24a(1) recites and the BzKJ enforces.

Set privacy and safety settings to the highest level by default for child users, and limit an unconnected adult's direct communication with a child user.

Set high default privacy settings.

Provide mechanisms for parents or guardians to supervise minors' accounts, guarantee safety and protection of children and adolescents by design, and keep the strictest available privacy and safety settings active by default when a new account is created (Article 4, items VI to VIII).

Default to the highest available privacy and safety settings for minors.

Configure all default privacy settings for a covered child and covered minor to the highest level of privacy: not display the location of the child or minor to other users, not display the users connected to them, disable search engine indexing of the account and disable interaction counts, and, if you use an algorithmic recommendation system to select, recommend or prioritize media or contacts between users, not display the account's content or media to a covered adult other than a parent and prohibit direct messaging with a covered adult other than a parent, unless the child or minor has expressly and unambiguously chosen otherwise.

Apply privacy-protective default settings for users you know are minors, including restricting contact and profile recommendations from unknown adults and limiting financial transactions.

Do not collect a minor's precise geolocation data beyond what is necessary to provide the service, and do not use a design feature meant to significantly increase, sustain, or extend a minor's use of the service without consent.

Guarantee the best interests of a child or adolescent in any processing of their data, and inform both the child and their parent or guardian, in clear and age appropriate language, before exercising the child's rights.

Where your online service is aimed at children, build in privacy-protective technical measures such as marking and filtering, write information for them in terms they can understand, keep advertising, entertainment and games clearly distinct from content, never incite a child to buy goods or enter an online contract, and never use prizes, rewards or links to a non-compliant site to keep them engaged.

Process a child's personal data in a manner that is in the best interest of the child, under Article 12.

Where you deploy an emerging technology such as artificial intelligence, the Internet of Things or blockchain to process personal data, set technical and organisational parameters that take account of safeguards for sensitive personal data, safeguards for child rights and other vulnerable groups, the right against solely automated decisions, the right to be forgotten, cross-border data flows, and privacy by design and by default.

Conduct regular data protection impact assessments to identify and mitigate privacy risks to children, and ensure data protection by design and by default when processing children's data.

Provide default privacy settings.

Put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for minors on your service.

Default child accounts to the most private settings.

Apply default privacy protections to minor accounts.

Unless a verified parent provides otherwise, by default limit data collection and use, and restrict targeted advertising, data sharing and specified design features, for known minors.

Set default privacy and safety settings for minors.

Comply with the Convention's fundamental principles across an AI system's lifecycle: human dignity and individual autonomy, equality and non-discrimination, respect for privacy and personal data protection, transparency and oversight, accountability and responsibility, reliability, and safe innovation.

Use technologies that are in accordance with the state of the art in the industry and the least privacy-intrusive, including with regard to data protection by design and by default, and that, to the extent they scan text in communications, are not able to deduce the substance of the content of the communications but are solely able to detect patterns which point to possible online child sexual abuse (Article 3(1), point (b)).

If that equipment, radio equipment designed or intended exclusively for childcare, radio equipment covered by Directive 2009/48/EC on the safety of toys, or radio equipment designed or intended to be worn on, strapped to, or hung from the human body or clothing is capable of processing personal data, or traffic data or location data, design and manufacture it to incorporate safeguards that protect the personal data and privacy of the user and of the subscriber (point (e); Article 1(2)).