Preparing for the PIA screening process

Sufficient information must be gathered to allow the criteria in the screening process to be applied. The following three steps are suggested:

Prepare a project outline
Undertake a stakeholder analysis
Perform an environmental scan

The screening process questions are likely be answered (at least provisionally) on the basis of the information arising from those three steps. If that is not the case, several further suggestions are offered.

1. Prepare a project outline

Risk management is most effective where it is commenced early in the project life-cycle. However, during the early stages of a project, there is only limited documentation available, and there may be uncertainty about the project's scope and the features of the intended system.

Early in the project life-cycle, the most likely sources of information are:

project initiation documents such as a Project Charter or Terms of Reference, and
interviews with relevant staff in the lead organisation, key stakeholders, members of the Project Steering Committee, and perhaps others as appropriate to the circumstances.

From this information, a relatively short description of the project can be prepared, as a basis for subsequent analysis. When it is being drafted early in the project, the project outline is likely to be a one to two page document.

Where the activity is conducted at a later stage of the project, much more information will be available, and the project outline should provide references to relevant documents, including descriptions of relevant technologies, predecessor systems and/or similar projects elsewhere.

Any previous PIAs conducted in an earlier phase of the project, or in relation to the development of the system that the project is intended to enhance or replace will be useful when preparing a project outline.

2. Undertake a stakeholder analysis

Those who may see themselves as 'having a stake' in the project should be identified at an early stage. This may include:

the organisation conducting the project, and perhaps also various sub-organisations within it;
other organisations directly involved in the project;
organisations and individuals that are intended to benefit from it;
organisations and individuals that may be affected by it, and possibly
organisations that provide technology and services to enable it

It is advisable to document the results of the stakeholder analysis in an appropriate form, most likely a one-page summary.

3. Perform an environmental scan

It may be valuable to seek out information about prior projects of a similar nature. Where new technology is being used, or the project applies existing technology in new ways, it is likely to assist the evaluation if descriptions of the technology and its applications are gathered.

The following sources may be considered:

Prior PIAs on similar projects, whether conducted:
- within the organisation
- by other organisations; or
- in other countries
Fact sheets, white papers, reports and refereed articles published by industry associations, technology providers, and research centres
Consultations with professional associations. Possibilities include CIO Connect, and the Chief Information Officer Council, but the orientation and expertise of organisations like these vary over time
Consultations with privacy regulators, in particular the Information Commissioner's Office
Consultations with other regulators, e.g., in the consumer rights arena
Consultations with non-government organisations that represent or provide advice to those potentially affected by the project.

These investigations may reveal designs and design features that have been devised by other project teams in order to address much the same categories of problem confronted by the project under consideration.

It is advisable to document the outcomes of the environmental scan in an appropriate form, most likely a one to two page summary, with reference to working documents generated during the process.

Apply the criteria

With the available information compiled, and documented in a convenient form, you can undertake the Screening Process. This involves applying criteria described in the following segment of the Handbook.

The purpose of the screening process is to ensure that the investment the organisation makes is proportionate to the risks involved. Depending on the scope and size of the project, only some elements of this Handbook will be relevant in any given case.

If insufficient information is available ...

It is possible that there will not be enough available information about the project to enable a clear conclusion to be reached in respect of any particular aspect. In that case, the following options are available: