Together with attorney Marco Mittone, I carry out Data Protection Impact Assessments (DPIAs) starting from the analysis and review of companies' software infrastructure. Mr. Mittone handles the legal aspects, while my work concerns how the software actually processes personal data: where and how it is stored, access control, retention periods, disclosure to third-party providers, and any transfers to third countries.
Areas of work
- Technical analysis of processing activities: mapping personal data flows between applications, databases, cloud services, and external providers, in support of the record of processing activities and the DPIA.
- Assessment of technical measures: access control, encryption of data at rest and in transit, log management, backups, retention and deletion policies.
- Privacy by design and by default in software design: data models that separate personal data from domain data, minimization, anonymization and pseudonymization, technical support for the exercise of data subjects' rights (access, rectification, erasure, portability), client-side encryption where appropriate.
- AI services and personal data: analysis of the personal data disclosed to language model providers through prompts and logs, assessment of the related risks and of mitigation measures (minimization, filters, locally run models).
Public talks
I covered these topics at CloudConf 2020 (Privacy by design in cloud architectures) and, together with Marco Mittone, at FullStackConf 2019 (Privacy in the Cloud: GDPR, Anonymization, and Deletion).