What Is Privacy Impact Assessment?

A privacy impact assessment examines a project or system to identify its effects on personal information and how risks to individuals will be addressed. Several regimes require one where processing is likely to present high risk.

Its distinguishing feature is the perspective: risk to the people whose data is processed, rather than risk to the organisation. Those diverge, and assessments that quietly substitute the second miss the point of the exercise.

When one is required

Under European law, where processing is likely to result in high risk — systematic monitoring of public areas, large-scale processing of sensitive categories, automated decisions with significant effects, or new technologies applied to personal data.

Quebec's modernised private sector law requires one for projects involving acquisition, development or overhaul of systems handling personal information, and before certain transfers outside the province. Public sector regimes in several jurisdictions impose their own triggers.

What it should contain

A description of the processing and its purpose. An assessment of necessity and proportionality — whether the objective could be achieved with less data or less intrusion.

Identification of risks to individuals. The measures addressing them. And a conclusion on residual risk, with consultation where a regime requires it. The necessity question is the one most commonly skipped and the one regulators focus on.

Timing decides whether it is useful

Conducted during design, it changes the design — less data collected, shorter retention, better access controls, a less intrusive technical approach.

Conducted before launch on a finished system, it produces a document and an awkward conversation, because the decisions it should have influenced are already implemented. That is the difference between the exercise working and satisfying a requirement.

Who should be involved

The project team, who know what is planned. Privacy or legal expertise, for the regulatory analysis. Security, for the protective measures. And in some cases the people affected, or their representatives, which several regimes encourage.

Where one function completes it alone, the result reflects that function's concerns. Security-led assessments produce good control descriptions and weak necessity analysis; legal-led ones produce the reverse.

It is evidence as well as analysis

Regulators request these during investigations, and their absence where one was required is a finding in its own right. Their presence, with documented decisions, demonstrates the accountability that several regimes require explicitly.

Which means they need to be retained, findable, and updated when the processing changes materially rather than filed once.

Automated decision-making has its own expectations

Where a system makes or substantially informs decisions about people without human involvement, several regimes require additional transparency, a route to human review, and explanation of the logic involved.

That now reaches a great deal of ordinary automation, including scoring, triage, eligibility and recommendation systems that were never described as artificial intelligence. Establishing whether any of your systems make consequential decisions automatically is the trigger question.

Where to start

Identify any current project involving new processing of personal data and ask the necessity question now, while the design can still change. That is the only point at which the assessment is cheap.

See Quebec Law 25 requirements. GuardsArm runs compliance auditing.