Contents
-
Using this handbook
-
Part 1 – Background information
-
-
Chapter I – Overview
-
Chapter II – Privacy, risks and solutions
- What is privacy?
- How is privacy protected?
- Why is privacy important?
- Privacy risks
- What do we mean by privacy risks?
- Recognising privacy risks
- Broad personal information issues
- Issues around identification of the individual
- Function creep
- Registration and authentication processes
- Surveillance
- Location and tracking
- Intrusions into the privacy of the person
- Persons at risk, and vulnerable populations
- Issues around the exercise of rights by individuals
- Future economic and social developments
- Relevant legal considerations
- Identifying privacy solutions
-
-
-
Part 2 – The PIA process
-
-
Process Maps
-
Chapter III – Initial assessment
-
Chapter IV – Full-scale privacy impact assessment
-
Chapter V – Small-scale privacy impact assessment
-
Chapter VI – Privacy law and other legal compliance checking
-
Chapter VII – Data Protection Act compliance check (including PECR)
-
Chapter VIII – Other ICO guidance
-
-
-
Appendix 1 – The PIA screening questions
-
Appendix 2 – Data protection compliance checklist template
-
Appendix 3 – PECR compliance checklist template
-
Appendix 4 – Privacy strategies
Why do a small-scale PIA?
The scope of the PIA should reflect the nature of the project as a whole. By conducting a full-scale privacy impact assessment on every project, regardless of its nature, scale or scope, an organisation may be committing too much resource for a project of limited scale or scope. This may lead to the PIA process being perceived as not delivering value for the organisation.
There is also a danger that too much full-scale public consultation may lead to fatigue among stakeholder groups, who themselves do not have the resources to devote to providing so many consultation responses. As a result, stakeholders may begin to channel resources into higher profile projects. This can lead to the PIA process not achieving one of its core aims of representing the privacy concerns from all perspectives, particularly in more limited projects.
A small scale PIA can be more readily scaled to fit the scale, scope and nature of a smaller project and will require less investment by the organisation.