Full-Scale PIA - Consultation strategy

Background

Any project that is sufficiently complex and potentially privacy-threatening that it requires a Full-Scale PIA affects many parties. The preparatory phase of the five-phase PIA process therefore includes the development of a consultation strategy. This document provides guidance in relation to that task.

For large-scale projects that embody significant privacy risks, all of the elements described below are likely to be relevant.

For small-scale projects some may well be superfluous. In this case, it is suggested that the document be used as:

• a checklist of possible elements of an appropriate consultation strategy, and
• an indication of the risks that need to be managed where elements are omitted.

The purpose of a consultation strategy is to assist in the management of the privacy risks involved in the project.

The benefits to the organisation of conducting consultation are:

• gathering of information about the privacy impacts of a project from all relevant perspectives;
• assisting the exchange of information among the participants;
• emergence of mutual appreciation by the various groups of one another's perspectives;
• identification of issues;
• creative construction of possible solutions;
• gaining of feedback about the acceptability of the possible solutions to the affected parties;
• avoidance of problems being discovered at a late stage of the project, when all possible solutions are expensive;
• avoidance of credible complaints being made at a late stage by affected parties that they were unaware of the project, or particular features, or of its impacts, and
• assurance that all relevant parties have the opportunity to contribute to the PIA, are seen to have that opportunity, and perceive themselves to have had that opportunity.

Developing a strategy

A 'consultation strategy' is distinctly different from a 'communications strategy'.

Effective consultation depends on all stakeholders being sufficiently well-informed about the project, having the opportunity to convey their perspective and their concerns, and developing confidence that their perspectives are being reflected in the design.

It is common for consultation processes to result in changes to the project and to its design. In order to make the maximum contribution to risk management in return for the smallest cost, consultation therefore needs to commence early and continue throughout the project life-cycle.

Key characteristics of effective consultation processes are:

• priming of discussions by means of an initial transfer of information about the project;
• ongoing information exchange among all parties;
• participation of representatives of and advocates for stakeholder groups, who have appropriate background in the technologies, systems and privacy impacts involved;
• facilitated interactions among the participants, and
• outcomes that demonstrate accommodation by the parties of the perspectives of other stakeholders.

Key considerations in the preparation of the consultation strategy are as follows:

• A sufficient diversity of participants to ensure that all relevant perspectives are represented, and all relevant information is gathered.
• Multiple rounds of:
  • information provision by the organisation
  • events that enable interactions among the various stakeholders.
• Assimilation of the information provided by all parties into the subsequent rounds of design and implementation activities.

An outline of the process of forming a consultation strategy is as follows:

• identify the preliminary set of issues that may arise from the project;
• identify the stakeholders that are likely to be affected by, or concerned about, the project;
• seek out representatives of those stakeholders;
• seek out advocates who have specialist knowledge about the relevant interests;
• form a PIA Consultative Group (PCG) by inviting a cluster of representatives and advocates that is not unduly large, but has sufficient diversity to ensure that the objectives are achieved, and
• devise communication processes that will enable the effective interchange of ideas. This will commonly involve workshops and meetings, perhaps supplemented by formal submissions. It is generally advisable to conduct at least one face-to-face meeting at the outset, in order to provide the opportunity for the members of the PCG to meet one another and establish rapport. However, it may be possible to undertake much of the activity remotely if the stakeholders have the necessary equipment and technical expertise.

The population segments affected by the project

Perhaps the most challenging aspect of a consultation strategy is to ensure effective access to the perspectives of those affected. Three broad approaches can be adopted:

1. Instead of undertaking consultations rely on the organisation and other stakeholders to identify and appreciate the views of those affected by the project
2. Conduct direct consultations with affected members of the public
3. Include within the PCG representatives of and/or advocates for affected members of the public

Failure to consult appropriately carries risk. It may be appropriate, however, where the organisation is already well-versed in the issues or is using a consultant that has well-established and current knowledge of the issues, or the project is building on a prior PIA, conducted by another organisation, which has involved direct consultation.

It is possible to approach direct consultations in two main ways:

• open meetings advertised and held in a variety of locations
• focus groups

Direct consultations are generally only effective, however, where the key aspects of the project are understood by the participants. They are generally not effective where new technologies that are little-understood by the public are planned to be used, or the assessment needs to consider options, alternatives and contingencies that are highly complex.

Whether or not open public processes are used, benefits can be gained by including in the consultations representatives or advocates of those affected. These two categories are usefully distinguished as follows:

• Representatives have plausible claims to represent the interests of some relevant constituency. Their credibility arises primarily from their closeness to that constituency, and their ability to sense and explain their constituency's concerns.
• Advocates have plausible claims to understand the interests of some relevant group of people, particularly in newly-emerging circumstances. Their credibility is based on their capacity to appreciate and consider the complexities and the options, and to present evidence and coherent arguments.

Where the organisation has an established public consultation strategy, or links with relevant organisations, the PIA Consultation Strategy should be devised in a manner consistent with the broader strategy, and should take advantage of the existing links.

If difficulties are encountered in identifying relevant stakeholder groups, or appropriate representatives/advocates, regulatory bodies may be able to assist. The experiences of other corporations, industry associations and government agencies, or of similar organisations in other jurisdictions, may also be relevant.

Effective consultative processes are dependent upon all parties having a mutual understanding of confidentiality. Trust is usually enhanced when organisations resist placing unnecessary restrictions on the documents used as the basis for discussions.

Where some of the material is commercially or security sensitive, it can be placed in separate appendices which can be subjected to confidentiality constraints without affecting overall trust. Some caution is required in relation to discussions. Confidence can be enhanced by providing all parties with protection for parts of the discussions where participants brainstorm and 'test the water'.

Where security considerations prevent the consultation processes from being fully open, it is suggested that:

• the PIA be undertaken in as open a manner as is possible;
• parts which have security concerns be separated into closed or confidential appendices and separate, relatively closed discussion sessions, and
• where security considerations result in the suppression of information, proxy measures be devised that are as effective and credible as possible. (For example, the security-sensitive information could be provided to a trusted third party who could then deliver to PCG members evaluative comments that avoid exposing the information)

An important consideration for effective consultation is access to financial resources to facilitate the participation of members of the public, and representatives and advocates. Individuals, and many public interest groups, lack the necessary funding base to enable suitable people to participate in PIA processes. A budget needs to be set aside for travel support and other possible expenses