A product team launches a personal-data feature and only afterward adds a privacy banner, calling that ‘data protection by design.’ Which correction is required?
Select an answer to reveal the explanation.
Short Explanation
Slapping a privacy sticker on a finished gadget is not ‘by design’ — that phrase means baking protection into the blueprint from the start. A late banner might help transparency, but it does not rewrite Article 25. Wait-for-breach encryption shopping is also too late as the whole story.
Full Explanation
Article 25 requires controllers to implement appropriate technical and organisational measures both at the time of the determination of the means for processing and at the time of the processing itself. Post-launch cosmetic measures alone do not fulfil data protection by design. Encryption may be a measure but timing and broader design choices matter. Article 25 imposes binding obligations on controllers, not optional slogans.