1. Privacy Impact Assessment Workshop Maureen H Falconer Sr Guidance & Promotions Manager Scotstat Public Sector Analysts Network 30 September 2010

2. Recognising Privacy Risk

3. PIA Decision Tree Initial Assessment No further action Full scale PIA? Small scale PIA? Privacy compliance check? DP compliance check? NO Complete full scale PIA & privacy, DP & other compliance checks Complete small scale PIA & privacy, DP & other compliance checks Complete privacy, DP & other compliance checks Complete DP compliance check YES

4. Initial Assessment Map PreparationStakeholder analysis Go through PIA screening questions to highlight privacy issues Decide level of assessment External information gathering Project outline

5. Denying anonymity or making identifiable previously anonymous transactions? Multiple organisational use? Increased volumes of data on individuals? Increased volumes of individuals? Processing data exempt from legislation? Disclosure to third parties not subject to comparable data protection? Will it involve… New or increased technology with substantial potential for privacy intrusion? New or re-using identifiers, intrusive identification/ authentication/ management processes? New handling processes for sensitive data? New or increased data matching? Increased public security measures? …do a full scale PIA.

6. If not, will it involve… New/changed data quality assurance processes and standards which may be unclear/unsatisfactory? New/changed data security arrangements which may be unclear/unsatisfactory? New/changed data access or disclosure arrangements which may be unclear/permissive? New/changed data retention arrangements which may be unclear/extensive? Changing medium of disclosure making data more readily accessible than before? …do a small scale PIA.

7. PIA Process Map Preliminary workPreparationDocumentation: conclusions & recommendations Review and audit Internal analysis External consultation/ information gathering

8. Identifying privacy risk… Personal Information Issues Issues around use of Identifiers Function Creep Centralisation of Data Vulnerability of Individuals Upholding Individuals’ Rights Identifying privacy solutions… Acceptance Mitigation Avoidance

9. Compliance Privacy Law: HRA; PECR; Law of Confidence Vires Statutory obligations/restrictions/prohibitions Data Protection: Schedule Conditions DP Principles Exemptions

10. Key Points The PIA is a process to consider privacy risk which provides: All-round perspective; Understanding of acceptability; Understanding of negative privacy impact; Justification for privacy intrusion Opportunities to lessen negative impact; Consideration of less privacy-invasive alternatives; Evidence based decision-making.

11. Information Commissioner’s Office 93-95 Hanover Street Edinburgh EH2 1DJ 0131 301 5071 Scotland@ico.gsi.gov.uk www.ico.gov.uk