Is Privacy Impact Assessment (PIA) Important?

In essence, a privacy impact assessment (PIA) is a systematic assessment of project that’s designed to:

• Identify the impact the project might have on the privacy of individuals
• Set out recommendations for minimising, eliminating, and managing impact

Along with data protection tools, a privacy impact assessment helps warrant a project complies with privacy laws. In addition, aside from compliance, a privacy impact assessment also helps warrant a project’s privacy implications and risks are taken into account.

A privacy impact assessment can also help determine whether a community will accept any planned use of sensitive or personal information involved in the project.

What is Personal Information?

In the Privacy Act, personal information is defined as, “information or an opinion an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in material form or not.”

Some of the common examples of personal information include but are not limited to:

• The individual’s name
• Medical records
• Telephone number
• Date of birth
• Bank account details
• Opinion or commentary about a person

What constitutes personal information however can vary, depending on whether an individual is reasonably identifiable or can be identified in a particular circumstance.

While a subset of personal information, sensitive information is typically accorded a higher level of protection under the Privacy Act. Sensitive information can include:

• Biometric and genetic information
• The individual’s health
• Political associations or opinions
• Philosophical or religious beliefs
• Ethnicity or race
• Criminal record
• Sexual orientation

Is Privacy Impact Assessment Important?

If a project involves handling of personal information, conducting a privacy impact assessment and publishing the report is considered crucial. Showing that the organisation has considered privacy accordingly can help create trust among the stakeholders as well as willingness to adopt a new service or product.

Integrating privacy impact assessment in the organisation’s risk management framework also shows an organisation’s effective and robust privacy systems, procedures, and practices. The primary step in the process is conducting a threshold assessment.

A threshold assessment can help determine if a full privacy impact assessment is required. In essence, the greater a project’s privacy scope and complexity are, the more likely it is that a comprehensive privacy impact assessment is required. A comprehensive privacy impact assessment can help determine and manage a project’s privacy impacts.

When Should a PIA Be Done?

Undertaking a privacy impact assessment should be done for projects that will handle personal information including designing of new legislation, service delivery, or products.

To ensure its effectiveness, a privacy impact assessment should be a key part of the project planning process as opposed to just an afterthought. In other words, a privacy impact assessment should be integrated in the project planning timeline from the very start.

Undertaking privacy impact assessment early in the project’s development will also give organisations the opportunity to influence the project design. Also, if there are likely negative impacts, organisations can easily reconsider moving along with the project.

A privacy impact assessment can also help organisations avoid unnecessary costs of addressing possible privacy concerns once a particular project has concluded.