The Value in Conducting a Privacy Impact Assessment Rachael Gallagher Senior Policy Officer 2 December 2014 RG

Introduction What is a PIA? What is Privacy? What are the benefits? What types of projects? Who should be responsible? RG

Code of Practice Privacy by design From Handbook to Code of Practice RG

The PIA process Consultation RG Identify need for a PIA 1 Identify need for a PIA 2 Describe information flows 3 Identify privacy risks 4 Identify privacy solutions 5 Record PIA outcomes, and sign-off 6 Integrate PIA outcomes into project plan All of the PIA should be capable of being integrated into your own project and risk management tools. Tweak as necessary Throughout all of this, consult with internal, contracted and external stakeholders RG

Consultation Internal stakeholders External stakeholders Project board Engineers, developers IT Procurement Suppliers / data processors Comms team Frontline staff Corporate Governance Senior management End users Data subjects Representative groups Interest groups General public Regulators Consultation should be timely – at the right stage of the project and with enough time to receive responses Clear and proportionate – explicit scope and focus Reach and representative – giving a voice to all those likely to be affected Ask objective questions and present realistic options Feedback – provide info about result of consultation MF

The PIA process Establish objectives, outcomes and outputs early 1 Identify need for a PIA Establish objectives, outcomes and outputs early Screening questions Management support All of the PIA should be capable of being integrated into your own project and risk management tools. Tweak as necessary Will need to have clear project objectives, outcomes and outputs to assist. Suggested screening questions will enable any project officer to identify the need for a PIA. Can then proceed with specialist input. Support of a senior manager will be important for conducting the PIA. MF

The PIA process Types of personal data Use of those data 2 Describe information flows Types of personal data Use of those data Information asset register Data controller? Thorough description of the types of personal data and how it is to be used within the scope of the project. Might be able to do this if you have an information asset register. MF

The PIA process Risk management tools/methodology ICO guidance 3 Identify privacy risks Risk management tools/methodology ICO guidance Other standards and guidance Types of risk Individuals Compliance Corporate Can use existing risk management tools to identify the privacy risks and possible solutions. RAG ratings will help you understand each risk better. Guidance from ICO, professional or trade associations, other appropriate regulators may be of assistance in understanding what risks there might be in aspects of your project Individual – inappropriate data sharing, function creep, intrusive/honey trap, mass merging of data, impact on vulnerable people/groups Compliance – Data Protection Act, PECR, Human Rights and Equalities Acts, legislation specific to organisation or sector. Professional standards and ethics Corporate – Regulatory actions, fines. Inadequate solutions lead to greater costs. Avoidance of engaging with project by others. Poor information management reduces business efficiencies, mistrust and reputational damage. Compensation claims or other court actions. MF

The PIA process Accept Reduce Eliminate MF Identify privacy solutions 4 Identify privacy solutions Accept Reduce Eliminate Any privacy risks should be proportionate to the project’s objectives. Can determine there is a risk, but it is low so accept that Can determine there is a risk but certain actions could reduce it Can determine that changing certain aspects could eliminate that risk entirely MF

The PIA process Document status of each risk Determine solutions 5 Record PIA outcomes, and sign-off Document status of each risk Determine solutions Record reasons Sign-off Publication Document status of each risk (accept, reduce, eliminate). Determine which solutions to progress to reduce the privacy risks to an acceptable level. Record reasons for each decision Have sign-off at a sufficiently high-level e.g. Project director or another Executive Director. If privacy risk assessment is off the chart, this should make the project board to question the validity of the project in its current form. Produce a proportionate PIA report and good practice to publish it, to make you transparent and to help other organisations at a later date. Good practice for public authorities to include PIAs in their publication scheme under FoI MF

The PIA process Recommendations integrated into project plan 6 Integrate PIA outcomes into project plan Recommendations integrated into project plan Review PIA at key stages Final evaluations PIA report all very well but recommendations must be included in project design to be meaningful. PIA should be reviewed and refreshed at key stages of the project, particularly where important changes have been made. Could be part of a gateway review for example. Also evaluate privacy along with the rest of the project once it has been delivered. MF

Conclusions Way of complying with data protection obligations Method of Good Practice Can reduce costs Publish where appropriate Promotes trust

Keep in touch Information Commissioner’s Office 3rd Floor, 14 Cromac Place, Gasworks,  Belfast BT7 2JB. Tel: 028 90278757 / 0303 123 1114  Email: ni@ico.org.uk Subscribe to our e-newsletter at www.ico.org.uk or find us on… www.twitter.com/iconews