This week the Information Commissioner's Office ('ICO') announced a consultation on its draft Conducting Privacy Impact Assessments Code of Practice (the 'draft code'). The draft code and the
This week the Information Commissioner's Office ('ICO') announced a consultation on its draft Conducting Privacy Impact Assessments Code of Practice (the 'draft code'). The draft code and the consultation document are available at http://www.ico.org.uk/about_us/consultations/our_consultations and the deadline for responding is 5 November 2013.
When it comes into force, the new code of practice will set out ICO's expectations on the conduct of Privacy Impact Assessments ('PIAs') and will replace ICO's current PIA Handbook. So why is the draft code important and how does it differ from the PIA Handbook?
The PIA Handbook is generally too cumbersome and convoluted. The aim of the draft code is to simplify the current guidance and promote practical PIAs that are less time consuming and complex, and as flexible as possible in order to be adapted to an organisation's existing project and risk management processes. However, on an initial review of the draft code I am not convinced that it achieves the optimum results in this regard. Consider for example the following expectations set out in the draft code which did not appear in the PIA Handbook:
Overall, although the draft code is certainly an improvement compared to the PIA Handbook, it remains cumbersome and prescriptive. It also places a lot of emphasis on documentation, recording decisions and record keeping. In addition, the guidance and some of the templates include privacy jargon that is unlikely to be understood by staff who are not privacy experts, such as project managers or work-stream leads who are most likely to be asked to populate the PIA documentation in practice.
Many organisations are likely to want a simpler, more streamlined and more efficient PIA process with fewer steps, simpler tools / documents and clearer guidance, and which incorporates legal requirements and ICO's essential expectations without undully delaying the launch of new processing operations. Such orgaisations are also likely to want to make their voice heard in the context of ICO's consultation on the draft code.
When it comes into force, the new code of practice will set out ICO's expectations on the conduct of Privacy Impact Assessments ('PIAs') and will replace ICO's current PIA Handbook. So why is the draft code important and how does it differ from the PIA Handbook?
- PIAs are a valuable risk management instrument that can function as an early warning system while, at the same time, promoting better privacy and substantive accountability. Although there is at present no statutory requirement to carry out PIAs, ICO expects them.
- For instance, in the context of carrying out audits, ICO has criticised controllers who had not rolled out a framework for carrying out PIAs. More importantly, the absence or presence of a risk assessment is a determinative factor in ICO's decision making to take enforcement action or not. When ICO talks about the absence or presence of a risk assessment, it means the conduct of some form of PIA.
- Impact assessments are likely to soon become a mandatory statutory requirement across the EU, as the current version of the draft EU Data Protection Regulation requires 'Data Protection Impact Assessments'. Note, however, that the DPIAs mandated by article 33 of the Draft Regulation have a narrower scope than PIAs. The former focus on 'data protection risks' as opposed to 'privacy risks', which is a broader concept that in addition to data protection encompasses broader notions of privacy such as privacy of personal behaviour or privacy of personal communications.
- The fact that ICO's guidance on PIAs will now take the form of a statutory Code of Practice (as opposed to a 'Handbook') means that it will have increased evidentiary significance in legal proceedings before courts and tribunals on questions relevant to the conduct of PIAs.
The PIA Handbook is generally too cumbersome and convoluted. The aim of the draft code is to simplify the current guidance and promote practical PIAs that are less time consuming and complex, and as flexible as possible in order to be adapted to an organisation's existing project and risk management processes. However, on an initial review of the draft code I am not convinced that it achieves the optimum results in this regard. Consider for example the following expectations set out in the draft code which did not appear in the PIA Handbook:
- In addition to internal stakeholders, organisations should work with partner organisations and with the public. In other words, ICO encourages controllers to test their PIA analysis with the individuals who will be affected by the project that is being assessed.
- Conducting and publicising the PIA will help build trust with the individuals using the organisation's services. In other words, ICO expects that PIAs will be published in certain circumstances.
- PIAs should incorporate 7 distinct steps and the draft code provides templates for questionnaires and reports, as well as guidance on how to integrate the PIA with project and risk management processes.
Overall, although the draft code is certainly an improvement compared to the PIA Handbook, it remains cumbersome and prescriptive. It also places a lot of emphasis on documentation, recording decisions and record keeping. In addition, the guidance and some of the templates include privacy jargon that is unlikely to be understood by staff who are not privacy experts, such as project managers or work-stream leads who are most likely to be asked to populate the PIA documentation in practice.
Many organisations are likely to want a simpler, more streamlined and more efficient PIA process with fewer steps, simpler tools / documents and clearer guidance, and which incorporates legal requirements and ICO's essential expectations without undully delaying the launch of new processing operations. Such orgaisations are also likely to want to make their voice heard in the context of ICO's consultation on the draft code.