Privacy Impact Assessment Guide

Full Table of Contents

• About This Guide
  • 1 How to use
  • 2 Meaning of certain concepts
• Overview of Privacy Impact Assessment
  • 3 What is a PIA?
  • 4 Why do a PIA?
  • 5 Benefits of a PIA
    • Compliance with privacy law
    • Reflecting community values
    • Project risk management
    • Other benefits
  • 6 How does a PIA work?
  • 7 Indicators that a PIA will be important
  • 8 Who does the PIA?
  • 9 Consultation and transparency
• Is a PIA Necessary?
  • 10 Threshold Assessment
• Approaching the PIA
  • 11 Key stages of a PIA
  • 12 Planning the PIA
• Doing the PIA
  • 13 Project description
  • 14 Mapping the information flows
  • 15 Privacy impact analysis
  • 16 Privacy management
  • 17 Recommendations
  • 18 The assessment has been done ... what then?
  • 19 Role of the Office
• Acknowledgements and Resources
  • Acknowledgements
  • PIA Resources
  • PIA Reports (or summaries)
  • Other Privacy Management Resources
• Endnotes

MODULE A Threshold Assessment

• Background
• How the Threshold Assessment works
• What is personal information?
• Suggested Threshold Assessment Template

MODULE B Nature of the Project

• Scope of the project
• Type of project and stage of development 
• Example A: Incremental projects of limited scope
• Example B: Projects at conceptual stage of development
• Example C: Significant projects at advanced stages of development

MODULE C Mapping the Information Flows

• 1 Collection
• 2 Use 
• 3 Disclosure
• 4 Access and correction
• 5 Security
• 6 Data quality
• 7 Identity management
• Endnotes

MODULE D Privacy Impact Analysis

MODULE E IPP Compliance Checklist

• A) Information Privacy Principles (IPPs)
  • 1) IPP 1 - Manner and purpose of collection
  • 2) IPP 2 - Solicitation of personal information from the individual concerned
  • 3) IPP 3 - Nature and method of personal information solicited
  • 4) IPP 4 - Storage and security of personal information
  • 5) IPP 5 - Information related to records
  • 6) IPP 6 - Access
  • 7) IPP 7 - Alteration of records
  • 8) IPP 8 - Record-keeper's obligation to check accuracy etc
  • 9) IPP 9 - Use only for relevant purposes
  • 10) IPP 10 - Limits on use for other purposes
  • 11) IPP 11 - Disclosure
• B) Commonwealth Contracts
  • 1) NPP 7 - Identifiers
  • 2) NPP 8 - Anonymity
  • 3) NPP 9 - Transborder data flows
  • 4) NPP 10 - Sensitive information
• IPP COMPLIANCE - CONCLUSIONS
• Endnotes

MODULE F Privacy Management