September 2017

LIGHTest and the principle of privacy by design: how technological innovation can make you safer

Online transactions are a part of everyday life, and most citizens engage in them without many second thoughts regarding their security and the impact on their privacy. And yet, we know that every transaction also comes with a cost. Every time we communicate online, there’s a possibility of our behaviour being monitored and analysed. Furthermore, we know that there are security risks to be managed: we need to keep our usernames and passwords safe, to minimise the risk of our identities being stolen or abused.


But the onus is not solely on the end user. There’s also increasingly an expectation that the technologies we use are designed with security and privacy in mind. The upcoming General Data Protection Regulation (GDPR), which will become Europe’s keystone legislation on privacy and data protection as of May 2018, enshrines this expectation into law. It creates an explicit principle of privacy by design, meaning that appropriate technical and organisation measures have to be baked into data processing technologies from the outset. Privacy and security rules have to be inherently supported by technologies, thus making sure that the likelihood and impact of incidents are minimised.


LIGHTest, fundamentally, is all about privacy by design in trust management. Our approach is firstly to use the DNS and its integrated security features as a way to reliably and securely discover trustworthy information. But secondly, we also created guidelines on how the technology should be used without compromising privacy. This includes the requirement not to make personal data directly discoverable via the DNS when using LIGHTest. It’s a simple good practice, but by making it explicit, LIGHTest not only supports innovation, but also ensures that our project outcomes don’t come with a privacy price tag. In this way, LIGHTest facilitates compliance with the GDPR for the users of its technologies, and helps to make everyday transactions just a little safer.