1. Privacy Impact Assessments (PIAs)
Ken Macdonald
Assistant Commissioner (Scotland & Northern Ireland)
UK Information Commissioner’s Office
14 March 2014

2. What is privacy? Privacy is about the integrity of the individual
Privacy of personal information
Privacy of the person
Privacy of personal behaviour
Privacy of personal communications

3. Why undertake a PIA? Identify and manage risk to individuals’ privacy
Avoid unnecessary costs
Avoid inadequate solutions
Avoid loss of trust and reputation
Support communications strategy
Meet legal requirements

4. Code of Practice New Code of Practice launched February 2014
Process Overview
Screening Questions / Templates

5. The PIA process Consultation 1 Identify need for a PIA 2
Describe information flows 3
Identify privacy risks 4
Identify privacy solutions 5
Record PIA outcomes, and sign-off 6
Integrate PIA outcomes into project plan

6. Consultation Internal stakeholders External stakeholders Project Team
Data Protection Officer
Engineers, developers IT
Procurement
Suppliers / data processors
Comms team
Frontline staff
Corporate Governance
Researchers
Senior management
End users
Data subjects
Representative groups
Interest groups
General public
Regulators

7. Fit with the Data Protection Principles
Personal data shall be
processed fairly and lawfully
obtained only for one or more specified and lawful purposes
adequate, relevant and not excessive
accurate and, where necessary, kept up to date
kept for longer than is necessary
processed in accordance with the rights of data subjects
protected against unauthorised or unlawful processing and against accidental loss, destruction or damage
transferred to a country or territory outside the European Economic Area only where is an adequate level of protection

8. The PIA process Establish objectives, outcomes and outputs early1
Identify need for a PIA
Establish objectives, outcomes and outputs early
Screening questions
Management support

9. The PIA process Types of personal data Use of those data2
Describe information flows
Types of personal data
Use of those data
Information asset register
Data controller?

10. The PIA process Risk management tools/methodology3
Identify privacy risks
Risk management tools/methodology
ICO guidance on particular risk areas
Other standards and guidance
Types of risk
Individuals
Compliance
Corporate

11. The PIA process Accept Reduce Eliminate4
Identify privacy solutions
Accept
Reduce
Eliminate
Cost:Benefit Analysis / Proportionality
Data Sharing Code of Practice
Anonymisation Code of Practice A

12. The PIA process Document status of each risk Determine solutions5
Record PIA outcomes, and sign-off
Document status of each risk
Determine solutions
Record reasons
Sign-off
Publication

13. The PIA process Recommendations integrated into project plan6
Integrate PIA outcomes into project plan
Recommendations integrated into project plan
Review PIA at key stages
Final evaluations

14. Keep in touch Head Office: 0303 123 1113 / casework@ico.org.uk
Northern Ireland /
Scotland /
Wales /