Unit Review: Privacy by Design for the Self 2.3A.2-R

Key Structural Points

• Privacy is not a preference — it is the structural precondition of independence, the sovereignty condition without which the virtues taught in Arc 1 cannot be fully exercised.

• The default condition of digital life is exposure; privacy by design reverses that default through four disciplines: minimize, separate, encrypt, and selectively disclose.

• The Personal Data Map makes the individual's data environment visible by inventorying what data exists, where it is held, who can access it, and what the consequences of compromise would be.

• Selective disclosure reverses the assumption that proof requires exposure: you prove a property of data (age threshold, qualification held, balance sufficient) without revealing the underlying data itself.

• Privacy by design at the individual level is the personal expression of the restraint principle — limiting data exposure so that a breach in one domain does not cascade across the individual's entire life.

• The asymmetry principle — institutions transparent, persons opaque — translates at the individual level into a design discipline: exposure by choice, not by default.

Philosophical Lexicon

• anonymous credential — A cryptographic mechanism that allows a person to prove membership in a class without revealing their identity. (RO)
• asymmetry principle — The structural commitment that institutions must be transparent and persons must be opaque. (RO)
• attestation — A verification mechanism that confirms a claim without exposing the underlying data. (RO)
• bounded interdependence — The requirement that every cooperative framework maintain clean exit, meaningful recourse, and data portability. (RO)
• commitment — A cryptographic mechanism by which a person commits to a value in a way verifiable after the fact without being visible during the process. (RO)
• compartmentalization — The restriction of data access to the minimum function required, enforced architecturally so that a breach in one function does not expose data held for another. (RO)
• privacy by design — The architectural commitment that persons remain selectively opaque to power; systems default to privacy and require justification for exposure, not the reverse. One of RO's nine design patterns. (RO)
• the restraint principle — An architectural extension that limits how much authority, coupling, complexity, and blast radius a system's safeguards may claim, treating limits as part of design rather than as corrections added after power grows. One of RO's nine design patterns. (RO)

Unit Glossary

• personal data map — A structured inventory of the individual's data environment tracking four dimensions: what data exists, where it is held, who can access it, and what the consequences of compromise would be. (RO)
• selective disclosure — The practice of proving a property of data (a condition is met) without revealing the underlying data itself; reverses the assumption that proof requires exposure. (RO)

Concept Check

• Why does the article describe privacy as a "structural precondition" of independence rather than a personal preference? What would be lost if the structural precondition were absent?

• Explain each of the four privacy disciplines (minimize, separate, encrypt, selectively disclose) and identify which mechanism of data exposure each addresses.

• What are the four dimensions tracked by the Personal Data Map? How does completing the map connect to the assumptions register from unit 2.3A.1?

• Give an example of selective disclosure in practice. What does the verifier learn, and what does the holder retain control over?

• How does privacy by design at the individual level express the restraint principle? What structural parallel exists between limiting data exposure and limiting systemic coupling?

• The article distinguishes privacy as engineering from privacy as ideology. What standard does the engineering approach set, and how does it differ from the claim that "nothing about me should be known"?

Points to Ponder

• Complete the first pass of the Personal Data Map for yourself. How many data categories did you identify that you had not previously considered? What was the most surprising entry?

• Consider the asymmetry principle — institutions transparent, persons opaque. In your current data relationships, where does the asymmetry run in the opposite direction — where do institutions know more about you than you know about them? What would it take to reverse even one of those relationships?

• Selective disclosure depends on the awareness that proof does not require exposure. Think of a recent situation where you provided more data than the verification required. What would a privacy-by-design alternative have looked like?

To Learn More

• Nissenbaum, Helen. Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford, CA: Stanford University Press, 2010. The foundational text for contextual integrity — the framework from which RO derives the principle that information flows must be appropriate to their context, not merely consented to.

• Cavoukian, Ann. "Privacy by Design: The 7 Foundational Principles." Information and Privacy Commissioner of Ontario, 2009. The originating framework for the design approach to privacy that RO adapts — relevant as the source pattern that Phase I admitted through the Rule of Admission.