Privacy impact assessment screening questions

A privacy impact assessment (PIA) is a systematic assessment of a project that identifies its impact on the privacy of individuals and sets out recommendations for managing, minimising or eliminating that impact. The OAIC says that to be effective, a PIA should be an integral part of project planning, not an afterthought. It is far cheaper to change a design than to fix a live system after a complaint or a breach.

Is a PIA required?

It depends on who you are.

Australian Government agencies covered by the Privacy Act must conduct a PIA for high privacy risk projects. This is required by section 12 of the Privacy (Australian Government Agencies – Governance) APP Code 2017. The OAIC explains that a project may be a high privacy risk project if the agency reasonably considers it involves new or changed ways of handling personal information that are likely to have a significant impact on individuals’ privacy.
Private sector organisations are not required by the Privacy Act to conduct PIAs. The OAIC encourages them to do so, and a PIA is one of the most practical ways to show that privacy has been considered from the start of a project.

Start with a threshold assessment

The OAIC’s Guide to undertaking privacy impact assessments recommends a threshold assessment for every project. The first question is simply whether personal information will be collected, stored, used or disclosed at all. If it will, the guide suggests recording a short description of the project, what personal information is involved and how sensitive it is, any changes to how existing information is handled, and whether a full PIA will proceed.

The questions below are a way to structure that threshold step. They are not a scoring tool. A “yes” to any one of them is a reason to look more closely, and several “yes” answers usually point towards a full PIA.

The information involved

Will the project collect, use, store or disclose personal information, including information that could identify someone when combined with other data?
Will it involve sensitive information, such as health, biometric, racial or ethnic origin, or criminal record information?
Will it involve a large quantity of personal information, or information about a large number of people?
Will it involve information about children or other people who may be vulnerable?
Is this an entirely new collection, or a new use or disclosure of information you already hold?

How it will be handled

Will the project combine, match or link datasets that were previously kept separate?
Will it use new technology, or use existing technology in a new way, such as AI, biometrics, tracking or location data?
Will a computer program make, or substantially contribute to, decisions that could significantly affect individuals?
Will it involve monitoring or surveillance of customers, staff or the public?
Will individuals be required to provide information, with no real choice?

Who else is involved

Will a supplier, contractor or cloud provider handle the personal information for you?
Will information be shared with other organisations, or across sectors or government?
Will personal information be stored or accessed outside Australia?

Impact on people

Could the project affect key aspects of someone’s life, such as their livelihood, housing, health, reputation, or access to services or entitlements?
Could a mistake, misuse or breach cause serious harm to the people involved?
Would the people affected be surprised by how their information is being used?
Is the project likely to attract significant community or media interest?

Changes to what already exists

Is the project a significant change to an existing system, process or purpose that already handles personal information?

What the answers tell you

The OAIC’s guide notes that the need for a full PIA grows with a project’s complexity and privacy scope. It lists factors such as large quantities of personal information, sensitive information, outsourcing, new technology, data matching, compulsory collection, and impacts on key aspects of people’s lives. These map directly to the questions above.

If you decide not to proceed to a full PIA, record the threshold assessment and the reasons. If the project changes, run the questions again. The OAIC also notes that projects using de-identified data may still warrant a PIA, to show how re-identification will be prevented.

Next step

Lexora helps organisations build a privacy governance framework, including when and how PIAs are triggered and who signs them off. If you would like to discuss a specific project first, book a free 20-minute call.

General information, not legal advice. Lexora is not a law firm. For advice on whether a PIA is required in your circumstances, consult a qualified legal adviser.