Privacy Impact Assessment (PIA) is the name for a process that analyzes and documents the future impact that processing their personal data will have on data subjects. "Privacy impact" are the - possibly unwanted and invisible - consequences that data processing may impose on individuals or society. Privacy impact is the result of personal data processing, data breaches or data collection.

The idea of privacy impact assessments has been around since the 1970ies. Roger Clarke summarizes the complete history of the concept and provides a global perspective on PIA in his article (Clarke, 2009).

Certain regularion requires privacy impact analysis before a new application can start with the collection and processing of personal data. In many countries, a mandatory PIA is to be performed when sensitive personal data is being processed (e.g. data about heatlh conditions, sexual orientation, religion).

Although the term "privacy impact analysis" is very popular, there is no systematic method to perform a PIA to this date. National authorities and expert organizations have published guidance and checklists. Sometimes, a PIA report is a required attachment for notifications of data processing to a supervisory government authority. A detailed analysis for various regulatory environments and their demands on PIA was published in (Tanrock, Pearson and Charlesworth ,2010).

In the following sections, we will recall Solove's taxonomy of privacy and privacy invasions, then we will examine the PIAF project's very extensive PIA process. Next, we compare carious PIA standards and guidelines to each other. Concluding, you will have a reading assignment about how to perform a PIA for RFID-enabled wireless technology.

Privacy impact on data subjects

Recall Dan Solove's "Taxonomy of privacy" from section 1, "The big picture" of this course! Figure 1 below shows once more the privacy-violating actions information collection, information processing, information dissemination and invasions.

Figure 1: Dan Solove's taxonomy of privacy shows how privacy breaches impact data subjects. Based on (Solove, 2006).

All four actions impact data subjects.

Information collection: Increases the information pool, thereby shifting power balances between data subjects and data processors. Collecting incorrect or ourdated information may later cause harm.
Information processing: Processing personal data, electronic decision making and accumulation of data may result in price discrimination, excluision, denial of service, incomplete or wrong service, wrong conclusions, unjustified data combination, classification errors.
Information dissemination: Information spreads to other processors, private or professional cicrles, the public, criminals, or personal enemies.Causes may be as part of the legitimate application, or as data breaches (hacking, data theft or system failures). Dissemination includes freedom-of-information enquiries and police, government and homeland security access.
Invasions: Invasions are all kinds of direct or indirect interactions back to the data subject that are based on personal data. From uninvited advertising via stalking to blackmail, any invasion and the effort to mitigate and prevent them should get considered.

We observe that data subjects are being put at risk already from the data collection step, and that risk is increasing with each step towards invasion. A privacy impact analysis must therefore consider the risks for data subjects that occur in the early phases before invasion occurs!

Conducting a PIA

In this part of the course, we will take a very brief look at the recommendation of the PIAF project about PIA to the European Union.

Core PIA elements

According to (PIAF D3, 2012), PIA is an overall process composed of the following steps:

1.An on‐going process: A PIA should be regarded and carried out as a process and not only as a single task of completion of a report. A PIA process starts early and continues throughout the life cycle of the project.

The PIA process is summarized as:

a.Early start in development project

b.Project description

c.Stakeholders’ consultation

d.Risks management

e.Legal compliance check

f.Recommendations and report

g.Decision and implementation of recommendations

h.Audit and review

Please note that steps b. to h. are similar to the Plan-Do-Check-Act cycle and the OASIS privacy management steps shown in section 1!

2.Scalability: A PIA policy should allow organisations to carry out a PIA appropriate to their own circumstances. A PIA policy should allow scalability of the PIA process.

3.All privacy types: As the rights to privacy and to protection of personal data are fundamental rights in the European legal order, for ensuring the highest level of protection thereof, a PIA should address all types of privacy issues and not only the protection of personal data.

4.Accountability: An organisation should be able to demonstrate that a PIA has been carried out adequately.

5.Transparency: A PIA process should enjoy at least a minimum level of transparency. Both the assessor and the stakeholders must have all relevant information to assess the privacy and data protection implications of the proposed project. This does not preclude due respect for sensitive information.

6.Stakeholders’ involvement: Stakeholders, as representative as possible, including the public, if applicable, should be identified and informed about the planned project and of the PIA process. Their views should be sought and taken into consideration. The PIA policy should provide explicit mechanisms for stakeholders’ consultation.

7.Publication of the PIA report: The PIA report should be made public and should be easily accessible.

8.Central public registry: There should be a public register of PIAs actually carried out and it should be easily accessible.

9.Sensitive information: State secrets and commercially sensitive information should not be made public.

10.Risks management and legal compliance check: Risks management and legal compliance check are core elements of PIA. To that end, effective procedures for risk management should be identified and/or developed.

11.Audit and review: A PIA process should be subjected to external review and/or audit.

Impact based on understanding of risk

When assessing privacy impact, a thorough understanding of privacy risk is needed. PIA needs to base its conclusions on privacy risks to data subjects and society, and gives these indications about how privacy risk is connected to impact assessment:

The assessor should identify, assess and mitigate all possible risks and other negative privacy impacts. Residual risks should be justified.
- Any risk management is only as good as the methodology underlying it. This means if the methodology is flawed, then so is the assessment.
- The risk assessment should take into account the impacts on both the individual and on society.
A PIA process requires a relative quantification of these risks. The Assessor should consider the likelihood and consequences of privacy risks occurring. Finally, the risk assessment requires evaluating the applicable risks. Thus the assessor should consider: (1) the significance of a risk and the likelihood of its occurrence, and (2) the magnitude of the impact should the risk occur. The resulting risk level can then be classified as low, medium or high.
Based on risk assessment: The assessor must define controls for privacy risk! Conctrols are Preventive controls (prevent violation) or detective controls (detect violation)
- Technical controls: go into the technical implementation of the project (e.g. security and PET mechanisms,anonymity, data minimization).
- Non-technical controls get implemented in processes, procedures, policies and operations.

However, as we have seen in the previous section on limitations of PETs in practice, the empirical fondations of the above risk assessment and control selection processes are scarcely available, and hence need to get built up with own resources.

Practical assessment of impact

The European Union Agency For Network and Information Security (ENISA) has published guidelines for privacy risk assessment for Small and Medium Enterprises (SME) (ENISA, 2016) that contain guidance on privacy impact assessment focused on individual data subjects in chapter 3 on page 19. There, four levels of privacy impact are defined:

LEVEL OF IMPACT	DESCRIPTION
Low	Individuals may encounter a few minor inconveniences, which they will overcome without any problem (time spent re-entering information, annoyances, irritations, etc.).
Medium	Individuals may encounter significant inconveniences, which they will be able to overcome despite a few difficulties (extra costs, denial of access to business services, fear, lack of understanding, stress, minor physical ailments, etc.).
High	Individuals may encounter significant consequences, which they should be able to overcome albeit with serious difficulties (misappropriation of funds, blacklisting by financial institutions, property damage, loss of employment, subpoena, worsening of health, etc.).
Very high	Individuals which may encounter significant, or even irreversible consequences, which they may not overcome (inability to work, long-term psychological or physical ailments, death, etc.).

Table 1: Privacy impact levels defined in (ENISA, 2016), p. 19

Reading assignment:

Please familiarize yourself with section 3.2 "Understanding and evaluating impact" in (ENISA, 2016) on pages 19-23!
Please read the privacy impact levels shown in table 1 and table 2 on pp.11-13 in CNSSI 1253F Attachment 6- Privacy Overlays !

PIA relates to data protection principles

The PIA assessments should for each transaction on personal data that gets assessed relate to the data protection priciples. The PIAF project recommends consideration of these priciples as part of the PIA assessment checklist:

Fair and lawful processing of data
Purpose specification
Adequate, relevant and not excessive for the purpose (data minimization)
Accurate and kept up to date
No longer than necessary for the purpose
In accordance to the rights of the data subjects
Appropriate measures for misconduct (including loss of data)
Transfer of personal data outside the EU/EEA

Overview over PIA standards

(Marnau, 2013) surveyed a number of PIA standards and guidelines publised in various coutries. Below in figure 2, you see the classification of the PIA guidelines. Full references can be found in (marnau, 2013).

All guidelines provide checklists or question lists for PIA. Only one of them, the BSI RFID PIA, has protection targets stated. The same guidelines are the only one with risk and attacker information available, and in addition provides risk treatment suggestions. The other guidelines are more or less lists of open questions with the intention to provide a PIA report. Most PIA frameworks must therefore get considered as an invitation to extentsive philosophical work.

Figure 2: Survey of PIA methods from TCLOUDS Deliverable 1.2.4 (Marnau, 2013)- Note that ISO/IEC 29134:2017 was not avilable at the time of analysis.

PIA example - self study

Please read the EU RFID Privacy Impact Assessment Framework for RFID applications (2011) [link]. It shows how to conduct a PIA. Please read the materials and answer yourself the questions below. There is no mandatory written submission for this task. You may, however, discuss your analysis with your fellow students using the discussion forum for section 3!

Learning questions:

How is the decision to perform a full-scale or small-scale PIA made?
Familiarize yourself with the privacy risks listed in ANNEX III of the document !

Please note that article 35 of the GDPR states that data protection impact assessments (DPIA) are mandatory for organisations with technologies and processes that are likely to result in a high risk to the rights of the data subjects.

In case you are interested in GDPR-compliant PIA, you can in addition read the Article 29 Committee Guidelines (WP 248) on high-risk PIA.

References

D. Solove, "A taxonomy of privacy," University of Pennsylvania Law Review, vol. 154, pp. 477-564, January 2006 [link]
PIAF project deliverable D3 - Recommendations for a privacy impact assessment framework for the European Union; Nov. 2012, especially section 2.2 on on-going process [link]
Ninja Marnau (ed.): Deliverable D1.2.4 Cloud Computing – Data Protection Impact Assessment, TClouds project, October 2013 [link]
Roger Clarke: Privacy Impact Assessment: Its Origins and Development, Computer Law & Security Review 25, 2 (April 2009) 123-135; [link]
David Tancock, Siani Pearson and Andrew Charlesworth: Analysis of Privacy Impact Assessments within Major Jurisdictions, Proceedings of PST 2010, Ottawa, Canada, IEEE, pp. 118-125, August 2010 [link]
EU RFID Privacy Impact Assessment Framework for RFID applications (2011) [link]
ENISA: Guidelines for SMEs on the security of personal data processing, December 2016, ISBN 978-92-9204-209-7, DOI 10.2824/867415, European Union Agency For Network and Information Security. [link]
ISO: ISO/IEC 29134:2017 Information technology — Security techniques — Guidelines for privacy impact assessment, 2017, International Organization for Standardization, [link] (commercial paywall access)
CNSSI 1253F, Attachment 6: Privacy Overlay, 04/23/2015 [link]

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.