Privacy Impact Assessments: international experience as a basis for UK guidance

In July 2007, the UK Information Commissioner’s Office commissioned a team of researchers, coordinated by Loughborough University, to conduct a study into Privacy Impact Assessments (PIAs). This was with a view to developing PIA guidance for the UK. The project resulted in two key deliverables: a study of the use of PIAs in other jurisdictions, identifying lessons to be learnt for the UK; and a handbook that can be used to guide organisations through the PIA process, taking into account the provisions of the UK Data Protection Act (DPA) 1998. This paper draws on the original research undertaken as part of that assignment to provide an overview of the ICO-funded project and the extent to which PIAs can be used in the current UK context. Firstly, the authors consider the findings of the comparative study and how the UK experience can be informed by developments overseas. Secondly, the paper outlines the development of the handbook during the course of the project and the extent to which it has been influenced by the overseas experience and the current UK political context. Thirdly, aspects of the handbook itself are considered and explained. Particular attention is paid to: its format; its key features; and feedback received on an interim version from a focus group of experienced data protection and project management practitioners. Finally, the paper concludes by stating why the study and the handbook provide appropriate tools for guidance in the current UK context, and how they can be developed further

Privacy Impact Assessments: the UK experience

This paper builds on original work undertaken as part of a team of researchers into Privacy Impact Assessments (PIAs), defined as a systematic risk assessment tool that can be usefully integrated into decision-making processes. The team were commissioned by the UK Information Commissioner’s Office (ICO) in June 2007 to develop a study of PIAs in overseas jurisdictions and a handbook to guide UK organisations through the PIA process. This research has subsequently attracted interest in the UK and overseas. PIAs are now mandatory for all UK central government departments. In this paper, the development of the project team’s PIA methodology and subsequent user experiences led to a key project output, the PIA handbook. The handbook has become a significant part of the privacy ‘toolkit’ and has impacted on public policy. Some important lessons from PIAs conducted in the UK and overseas are identified. Finally, areas are outlined for further development