Preparing for the PIA screening process
Sufficient information must be gathered to allow the questions in the screening process to be applied. It is possible that there will not be enough available information about the project to enable a clear conclusion to be reached in respect of any particular aspect. To help ensure that enough information is available to decide which level of PIA, if any, is required, the following three pieces of information are needed:
The screening process questions are likely be answered (at least provisionally) on the basis of this information.
Obtain or develop a project outline
During the early stages of a project, there is only limited documentation available, and there may be uncertainty about the project’s scope and the features of the intended system.
To ensure that you know what the project’s aims are and to start thinking about what the potential impact of the project might be, make sure you get a copy of the project initiation documents, such as a project charter or terms of reference.
If such documents are not available, consult with relevant staff in the lead organisation, key stakeholders, members of the project steering committee, and perhaps others as appropriate to the circumstances. From this information, a relatively short description of the project can be prepared if necessary, as a basis for subsequent analysis.
Where the activity is conducted at a later stage of the project, much more information will be available, and the project outline should provide references to relevant documents, including descriptions of relevant technologies, predecessor systems and/ or similar projects elsewhere.
Any previous PIAs conducted in an earlier phase of the project, or in relation to the development of the system that the project is intended to enhance or replace, will be useful when preparing a project outline.
Undertake a stakeholder analysis
This involves making a list of any groups or organisations who may have an interest in, a role to play in delivering, or be affected by your project. This could include:
- the organisation conducting the project, and perhaps also various sub-organisations within it;
- other organisations directly involved in the project;
- organisations and individuals that are intended to benefit from it;
- organisations and individuals that may be affected by it; and
- organisations that provide technology and services to enable it.
At this stage you want to have as broad a list of groups as possible with a very brief description of the stake each group might have in the project. This list can be edited down later for more focused consultation. At this stage any analysis of stakeholders should be brief, ideally a one page summary.
See what else is out there
It may be valuable to seek out information about prior projects of a similar nature. Where new technology is being used, or the project applies existing technology in new ways, it is likely to assist the evaluation if descriptions of the technology and its applications are gathered.
The following sources may be considered:
- Prior PIAs on similar projects, whether conducted within the organisation, by other organisations or in other countries.
- Fact sheets, white papers, reports and refereed articles published by industry associations, technology providers, and research centres.
- Consultations with professional associations. Possibilities include CIO Connect, and the Chief Information Officer Council, but the orientation and expertise of organisations like these vary over time.
- Consultations with privacy regulators, in particular the Information Commissioner’s Office.
- Consultations with other regulators, eg in the consumer rights arena.
- Consultations with non-government organisations that represent or provide advice to those potentially affected by the project.
These investigations may reveal designs and design features that have been devised by other project teams in order to address much the same categories of problem confronted by the project under consideration.
As with the rest of the preparation work, this does not have to be exhaustively catalogued, a one to two page summary, with reference to working documents generated during the process should be enough.