Privacy Impact Assessments Iain Bourne, Group Manager, Policy Delivery Information Commissioner’s Office, UK Workshop on data protection and the internet: Zagreb, June 2013

Privacy Impact Assessments “A PIA is a process which helps assess privacy risks to individuals in the collection, use and disclosure of information. PIAs help identify privacy risks, foresee problems and bring forward solutions.” ICO PIA Overview, 2009

Some obvious PIA questions Why will you collect this information? Are there alternatives to using personal data – e.g. in planning How long will you keep it for? Who will need to have access to it? How will you check it is correct? How will you keep it secure? How will you get rid of it when you no longer need it? How will we tell the public what we’re doing? So, the PIA turns the principles of data protection into a business process.

Some internet PIA issues ‘signed-in’ or ‘anonymous’ access to services? Personal data for web metrics / analytics? When does pseudonymisation or anonymisation take place? How to deal with policing / national security requests Can people find and understand our privacy policy? Do we need consent – e.g. cookies? How do we get it? Do we disclose personal data to third parties – e.g. advertisers? What do we have to consider when launching a new service?

‘threshold’ criteria questions 1 (1) Does the project apply new or additional information technologies that have substantial potential for privacy intrusion? (2) Does the project involve new identifiers, re-use of existing identifiers, or intrusive identification, identity authentication or identity management processes? (3) Might the project have the effect of denying anonymity and pseudonymity, or converting transactions that could previously be conducted anonymously or pseudonymously into identified transactions?

‘threshold’ criteria questions 2 (4) Does the project involve multiple organisations, whether they are government agencies (eg in 'joined-up government' initiatives) or private sector organisations (eg as outsourced service providers or as 'business partners')? (5) Does the project involve new or significantly changed handling of personal data that is of particular concern to individuals? (6) Does the project involve new or significantly changed handling of a considerable amount of personal data about each individual in the database? (7) Does the project involve new or significantly changed handling of personal data about a large number of individuals?

‘threshold’ criteria questions 3 (8) Does the project involve new or significantly changed consolidation, inter-linking, cross-referencing or matching of personal data from multiple sources? (9) Does the project relate to data processing which is in any way exempt from legislative privacy protections? (10) Does the project's justification include significant contributions to public security measures? (11) Does the project involve systematic disclosure of personal data to, or access by, third parties that are not subject to comparable privacy regulation?

From our compliance-check template 1.4 Obtaining consent Are you relying on the individual to provide consent to the processing as grounds for satisfying Schedule 2? Yes No If yes, when and how will that consent obtained? For the processing of sensitive personal data, are you relying on explicit consent as specified in Schedule 3, s1 of the Data Protection Act? Yes No If so, when and how will that consent obtained?

Context ICO PIA handbook 2007, second edition 2009 – a ‘how to do it’ guide Value of PIAs in guiding new organisational activities/decisions/projects that impact on privacy Starting to mature as a discipline as good practice and case studies emerge Usage rising but barriers exist to widespread usage Practitioners want flexibility, clearer business case for PIAs, clearer links with existing organisational business processes Further work needed on embedding PIAs Quality still variable – still used as a “check box” exercise or cover to justify project by some

Context – wider developments Proposed European Data Protection Regulation Article 33 – Data Protection Impact Assessments European PIAF Project: - ISO PIA standard

Where next? ICO announcement mid July. PIA “package” will be published: New draft Code of Practice for consultation – including annex on project and risk management Full research findings published Action plan for consultation – responding to research recommendations. Influencing stakeholders that “own” project and risk management methodologies

Where next? New ICO Code of Practice (replaces but builds on 2009 handbook). Will cover: –When to use a PIA –Building PIAs into how organisations manage projects and risks –Practical steps to identify and manage privacy risk –How to build consultation throughout the process – internal and external –Publication of PIA reports –Includes templates, but organisations and sectors are encouraged to develop their own approach

Proposed DP Regulation: Article 33 Data protection impact assessment 1. Where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes, the controller or the processor acting on the controller's behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.

Keep in touch Subscribe to our e-newsletter at or find us on…