{"id":4898,"date":"2024-02-29T09:29:01","date_gmt":"2024-02-29T09:29:01","guid":{"rendered":"https:\/\/blogs.gov.scot\/digital\/?p=4898"},"modified":"2024-02-29T10:09:47","modified_gmt":"2024-02-29T10:09:47","slug":"privacy-by-design-and-default-scotaccount","status":"publish","type":"post","link":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/","title":{"rendered":"Privacy by design and default \u2013 ScotAccount"},"content":{"rendered":"

Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount.\u00a0\u00a0<\/strong><\/p>\n

ScotAccount is an online service that allows people to sign in to public services in a user-centred and secure way. It makes accessing services easier and simpler because you will be able to use one account to sign in to a variety of services. You can also verify your identity, if necessary, and choose to save your verified personal information in your ScotAccount so you can use it again when applying for other public services.<\/span>\u00a0<\/span><\/p>\n

Our approach towards privacy\u00a0<\/span><\/b>\u00a0<\/span><\/p>\n

In my previous blog<\/span><\/a>, I introduced you to the privacy, security, and usability principles I use within Scottish Government to embed security in service design.\u00a0<\/span>\u00a0<\/span><\/p>\n

In this blog, I share more detail on the first of those three principles \u2018Privacy by design and default\u2019. My next blogs in this series will cover the other two areas.<\/span>\u00a0<\/span><\/p>\n

Privacy is fundamental to ScotAccount. We understand that for the service to be trusted, it needs to demonstrate how personal data is being processed, as well as why, where and by whom.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

Data protection legislation also sets out legal requirements on how organisations, businesses and government use personal data that we must adhere to.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

As a rule, I approach security threat modelling and risk assessment of a service in terms of the confidentiality, integrity, and availability of information. The confidentiality assessment typically surfaces privacy-related risks and focuses any security efforts required to manage those risks. This activity is carried out once the solution architecture is clearly understood, and before any build work takes place.\u00a0<\/span>\u00a0<\/span><\/p>\n

For ScotAccount, I wanted to take a different approach given how integral privacy is to the service and how important it is that end-users can trust we are protecting their data every step of their journey. With that in mind, I commissioned a specific privacy threat model and risk assessment involving the Scottish Government information assurance and data protection team to evaluate an early conceptual idea of what ScotAccount could look like.\u00a0<\/span>\u00a0<\/span><\/p>\n

By completing the privacy modelling and assessment much earlier in the development process, the anticipated privacy risks influenced the solution architecture and fed into the subsequent security threat modelling and risk assessment activity. There is a very good Privacy Threat Modelling podcast episode available from <\/span>C<\/span>hris Romeo\u2019s ‘the Threat Modelling Podcast\u2019 series<\/span><\/a> if you wanted to hear more on the value of this approach.<\/span>\u00a0<\/span><\/p>\n

I also brought the same information assurance and data protection team into ScotAccount\u2019s security and privacy governance board. There, they can directly challenge and support the service designers\u2019 feature proposals from a privacy perspective, ensuring that where any involve personal data being processed, these are reviewed to meet regulatory needs such as proportionality, necessity, and lawfulness.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

Through this approach towards privacy and data protection, I believe that a clear demonstration of privacy by design and default has and continues to be demonstrated within the ScotAccount service.<\/span>\u00a0<\/span><\/p>\n

The importance to the public sector<\/span><\/b>\u00a0<\/span><\/p>\n

Demonstrating privacy by default and design is not only important to ScotAccount end-users, but also the public service organisations adopting ScotAccount. This includes <\/span>Disclosure Scotland<\/span><\/a>, who are working in partnership with us to help shape the service.<\/span>\u00a0<\/span><\/p>\n

We are doing this in several ways. One of these involves demonstrating compliance with a range of standards. Most are cyber security focused such as <\/span>ISO\/IEC 27001<\/span><\/a>, but there are also privacy-specific standards including <\/span>ISO\/IEC 27701<\/span><\/a> which is called for under the <\/span>UK Government trust framework<\/span><\/a>. We are aligned with these for the benefit of ScotAccount end-users and our service customers.<\/span>\u00a0<\/span><\/p>\n

We are also ensuring that privacy supporting features are built into ScotAccount to address the risks we have identified and assessed. The <\/span>National Cyber Security Centre (NCSC) guidance on security outcomes<\/span><\/a> covers many of the features we have built and are continuously improving. These include data encryption, multi-factor authentication, regular security penetration testing with NCSC approved suppliers, actively managing software vulnerabilities, security monitoring and well-rehearsed incident response plans.\u00a0<\/span>\u00a0<\/span><\/p>\n

ScotAccount also has the benefit of an external advisory <\/span>Expert Group<\/span><\/a> who have a strong ethics and privacy-focus amongst their membership. This has been invaluable to the service, allowing us to obtain challenge and support where needed.<\/span>\u00a0<\/span><\/p>\n

A look to the future<\/span><\/b>\u00a0<\/span><\/p>\n

Finally, privacy by design and default is not something you do at the start and shel<\/span>ve<\/span> once you are fully operational. I am regularly looking <\/span>at privacy-enhancing technologies<\/span><\/a> and evolving guidance with a view to continuously challenging and improving the privacy of digital services, this includes, for example, the <\/span>ICO consultation on the draft biometric data guidance<\/span><\/a>.\u00a0\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

In my next blog, I will talk more about \u2018Security by design and default\u2019 and explore the balance of making <\/span>ScotAccount<\/span> secure and efficient, without breaking it or making it unusable.<\/span>\u00a0<\/span><\/p>\n

The final blog in the series will cover the \u2018Usability by design and default\u2019 principle, exploring the experience we want to deliver and how we are making it as widely usable as possible.<\/span>\u00a0<\/span><\/p>\n

How to contact the team<\/span><\/b>\u00a0<\/span><\/p>\n

You can subscribe to\u202f<\/span>Scottish Government Digital Scotland newsletter<\/span><\/a>\u202ffor regular updates on ScotAccount and other digital projects.<\/span>\u00a0<\/span><\/p>\n

If you work for a public service organisation and are interested in finding out more about ScotAccount, or to access our test environment, you can get in touch with<\/span> the team by emailing: <\/span>scotaccount@gov.scot<\/span><\/a>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount.\u00a0\u00a0 ScotAccount is an online service that allows people to sign in to public services in a user-centred and secure way. It makes accessing services easier and…<\/p>\n","protected":false},"author":317,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[157,400],"tags":[19,146,394,98,387,94],"class_list":["post-4898","post","type-post","status-publish","format-standard","hentry","category-digital-identity","category-scotaccount","tag-digital","tag-digital-scotland","tag-digital-scotland-service-standard","tag-identity","tag-scotaccount","tag-scotland"],"yoast_head":"\nPrivacy by design and default \u2013 ScotAccount - Digital<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Privacy by design and default \u2013 ScotAccount - Digital\" \/>\n<meta property=\"og:description\" content=\"Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount.\u00a0\u00a0 ScotAccount is an online service that allows people to sign in to public services in a user-centred and secure way. It makes accessing services easier and...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/\" \/>\n<meta property=\"og:site_name\" content=\"Digital\" \/>\n<meta property=\"article:published_time\" content=\"2024-02-29T09:29:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-02-29T10:09:47+00:00\" \/>\n<meta name=\"author\" content=\"Stewart Hamilton\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Stewart Hamilton\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/\"},\"author\":{\"name\":\"Stewart Hamilton\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552\"},\"headline\":\"Privacy by design and default \u2013 ScotAccount\",\"datePublished\":\"2024-02-29T09:29:01+00:00\",\"dateModified\":\"2024-02-29T10:09:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/\"},\"wordCount\":904,\"commentCount\":0,\"keywords\":[\"digital\",\"Digital Scotland\",\"Digital Scotland Service Standard\",\"identity\",\"ScotAccount\",\"scotland\"],\"articleSection\":[\"Digital Identity\",\"ScotAccount\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/\",\"url\":\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/\",\"name\":\"Privacy by design and default \u2013 ScotAccount - Digital\",\"isPartOf\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#website\"},\"datePublished\":\"2024-02-29T09:29:01+00:00\",\"dateModified\":\"2024-02-29T10:09:47+00:00\",\"author\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552\"},\"breadcrumb\":{\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blogs.gov.scot\/digital\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Privacy by design and default \u2013 ScotAccount\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#website\",\"url\":\"https:\/\/blogs.gov.scot\/digital\/\",\"name\":\"Digital\",\"description\":\"Updates from the Scottish Government's Digital Directorate\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blogs.gov.scot\/digital\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552\",\"name\":\"Stewart Hamilton\",\"description\":\"Communications and Engagement Officer\",\"url\":\"https:\/\/blogs.gov.scot\/digital\/author\/stewarthamilton\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Privacy by design and default \u2013 ScotAccount - Digital","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/","og_locale":"en_GB","og_type":"article","og_title":"Privacy by design and default \u2013 ScotAccount - Digital","og_description":"Laurie Brown, Digital Information Security Officer, provides strategic information security direction, assurance, and governance across a number of Scottish Government digital public services including the work to introduce ScotAccount.\u00a0\u00a0 ScotAccount is an online service that allows people to sign in to public services in a user-centred and secure way. It makes accessing services easier and...","og_url":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/","og_site_name":"Digital","article_published_time":"2024-02-29T09:29:01+00:00","article_modified_time":"2024-02-29T10:09:47+00:00","author":"Stewart Hamilton","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Stewart Hamilton","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/#article","isPartOf":{"@id":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/"},"author":{"name":"Stewart Hamilton","@id":"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552"},"headline":"Privacy by design and default \u2013 ScotAccount","datePublished":"2024-02-29T09:29:01+00:00","dateModified":"2024-02-29T10:09:47+00:00","mainEntityOfPage":{"@id":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/"},"wordCount":904,"commentCount":0,"keywords":["digital","Digital Scotland","Digital Scotland Service Standard","identity","ScotAccount","scotland"],"articleSection":["Digital Identity","ScotAccount"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/","url":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/","name":"Privacy by design and default \u2013 ScotAccount - Digital","isPartOf":{"@id":"https:\/\/blogs.gov.scot\/digital\/#website"},"datePublished":"2024-02-29T09:29:01+00:00","dateModified":"2024-02-29T10:09:47+00:00","author":{"@id":"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552"},"breadcrumb":{"@id":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blogs.gov.scot\/digital\/2024\/02\/29\/privacy-by-design-and-default-scotaccount\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blogs.gov.scot\/digital\/"},{"@type":"ListItem","position":2,"name":"Privacy by design and default \u2013 ScotAccount"}]},{"@type":"WebSite","@id":"https:\/\/blogs.gov.scot\/digital\/#website","url":"https:\/\/blogs.gov.scot\/digital\/","name":"Digital","description":"Updates from the Scottish Government's Digital Directorate","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blogs.gov.scot\/digital\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/blogs.gov.scot\/digital\/#\/schema\/person\/fd47935c780321ad6c4ecbb2f10da552","name":"Stewart Hamilton","description":"Communications and Engagement Officer","url":"https:\/\/blogs.gov.scot\/digital\/author\/stewarthamilton\/"}]}},"_links":{"self":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/posts\/4898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/users\/317"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/comments?post=4898"}],"version-history":[{"count":0,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/posts\/4898\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/media?parent=4898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/categories?post=4898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gov.scot\/digital\/wp-json\/wp\/v2\/tags?post=4898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}