Privacy Awareness Card

Together, consider a scenario involving a data protection incident from your everyday life or work environment. Then, write down all relevant details on the corresponding scenario card. The more specific and precise your description of the incident, the easier it will be to complete the steps that follow.

Collaboratively develop a concrete scenario for a data protection incident. Think of an incident that could realistically occur in your everyday life, at school, during your studies, or in your workplace – or perhaps one that has already happened.

Describe the incident as precisely as possible:

• Where and when does it take place?
• How does the incident unfold?
• Who is involved?
• Which data is affected?
• How was the incident discovered?

Record all relevant details of your scenario on the scenario card. The more vivid and specific your description of the data protection incident is, the easier it will be to identify suitable stakeholders, data, consequences, goals, and actions in the next steps.

Can’t think of your own scenario? Get inspired by common data protection incidents: a lost USB stick, a misaddressed email containing sensitive data, unencrypted cloud storage, or accidentally sharing photos in a messenger group are classic examples. Remember: the more realistic the scenario, the more engaging the discussion!

Example:

On May 31, 2024, a significant data breach occurred at an international service provider for the online sale of tickets to concerts, sporting events, and other events. The personal data of approximately 560 million customers was exposed through a data leak. Among the information affected were names, addresses, phone numbers, and email addresses of users. Sensitive details about order history, including ticket purchases, also fell into the wrong hands. In addition, parts of payment data—including the cardholder’s name, the last four digits of the credit card, and the expiration date—were made public.

Once you have described your scenario, go through the following three categories together and select the appropriate cards. Place the selected cards clearly visible on the board so that you have a clear overview of the data protection incident and the elements involved.

Select the three most important Privacy Protection Goals for this incident and place them on the board in order of priority.

After you have placed all the cards for stakeholders, affected data, and possible impacts on the board, take another close look at your scenario. As a team, consider which data protection goals are most important in your specific case.

Go through the five classic data protection goals (confidentiality, integrity, availability, transparency, and intervenability). Discuss as a team which three goals should have the highest priority in your specific data privacy incident. For example, ask yourselves:

• Is it more important that unauthorized persons do not gain access to the data (confidentiality)?
• Or is it a priority that the data is always correct and accessible (integrity and availability)?
• Do transparency and the ability of data subjects to have a say play a special?

Agree on the three most important goals for your scenario. Place the corresponding data protection goal cards on the board in the order of your priorities—first the most important, then the second and third most important.

Briefly justify your selection so everyone understands the reasons for your chosen order.

There is no absolute "right" or "wrong" in this process—the key is to have an open discussion and thoughtfully consider the key aspects of your scenario as a team.

1. Confidentiality Personal data may only be accessed or processed by authorized individuals. Unauthorized persons must not have access. The goal is to protect information from unauthorized access, disclosure, or publication.
2. Integrity The accuracy and completeness of personal data must be ensured. Data must not be altered, deleted, or falsified unintentionally or without authorization. This ensures that stored information remains correct and reliable.
3. Availability Personal data must always be available and accessible to authorized users when needed. System failures, data loss, or accidental deletions must not result in data becoming lost or inaccessible.
4. Transparency The processing of personal data should be understandable and traceable for the individuals concerned. They must be able to know when, how, and why their data is used. This also includes being informed about their rights.
5. Intervenability Data subjects must have the ability to influence how their data is processed, for example through requests for information, corrections, blocking, or deletion of their data. Errors or misunderstandings in data processing should also be easily correctable.
6. Unlinkability Separate data records must not be linked in such a way that individuals can be identified or their behavior can be extensively monitored. The goal is to prevent the creation of detailed personal profiles or comprehensive surveillance through the combination of different pieces of information.

Discuss alternatives, possible improvements, and your personal views regarding priorities and measures.

After placing the cards on the board, take some time to discuss your results as a team. This step is especially important to reinforce what you have learned and to include different perspectives.

Together, review your scenario, the involved stakeholders, the types of data affected, the selected impacts, your prioritized privacy protection goals, and the measures you have chosen. As you do so, discuss the following questions:

• Which decisions were easy, and which were difficult to make?
• Are there any alternative solutions or measures that you might have overlooked?
• With what you know now, would you prioritize or select any measures differently?
• How effective and realistic do you think the chosen measures are in your everyday life or work environment?
• What challenges might you encounter when trying to implement them?

Personal reflections:

• What aspects of privacy protection do you consider most important?
• Did this workshop make you aware of any risks or problems you hadn’t considered before?
• Were there any surprises or new insights?

Feedback and suggestions for improvement:

• What did you particularly like about the workshop, and what could be improved for next time?
• What topics or scenarios would you like to explore in the future?