How and When To Use a Threshold Privacy Impact Assessment

Threshold Privacy Impact Assessments offer organisations a privacy check-in at the earlier stages of any project. They’re fast, easy to understand, and can help to reduce and manage privacy risks. They also help to ensure privacy teams are looped in at the right time, ensuring their focus is directed where needed.

In this post, we look into what a Threshold PIA is, how and when to use one, and what to keep in mind as you start the Privacy Impact Assessment process. 

What is a Threshold PIA?

A Threshold Privacy Impact Assessment is the first step (and sometimes the last step) in a more comprehensive PIA process. It asks a small number of questions to try to determine whether the more detailed PIA is required in the first place. 

Generally, the purpose of a threshold PIA is to determine whether: 

1. Personal information is being collected, used or stored as part of a project; and if so, 
2. Whether it proposes any changes to existing information handling practices, and
3. If there are any new or greater privacy risks that need to be considered.

If there’s either no personal information being collected or no proposed changes to existing information handling practices that have already been assessed, then you likely won’t need a full PIA. So, threshold privacy impact assessments can help your organisation manage its resources, ensure timely privacy reviews and direct your resources where they’re needed. 

Benefits of Threshold Privacy Impact Assessments

The main benefit of threshold PIAs is that it can help organisations, particularly large organisations, to direct privacy team resources where they’re most needed. But there are other benefits that come with them, including: 

• Early risk identification: Threshold PIAs are less resource intensive and take less time than complete PIAs. This reduces barriers for using them as a tool earlier in the process, and promotes early risk identification. 
• Creating a culture of privacy: Requiring team members outside of the privacy team to identify when personal information is being collected, stored, and used helps to keep privacy top of mind. This can create a culture of privacy within an organisation. 
• Clear documentation, which can help you defend decisions made if required at a later stage.  

What questions would you typically include in a Threshold Privacy Impact Assessment?

The Office of the Information Commissioner Queensland has created a helpful document covering the types of questions your Threshold Privacy Impact Assessment may include. The template suggests that if the answer is ‘yes’ to any of the following questions, the project likely warrants a complete Privacy Impact Assessment. We’ve categorised and summarised them as follows:

Data Collection and Usage

• Will the project collect personal information? Does it involve collecting information from a new or existing source?
• Will it use personal information in a new way? Is information already held being used for a different purpose than originally intended?
• Will it link, match, or analyze personal information? Does the project involve cross-referencing or analyzing data?
• Will it risk re-identifying a person? Could de-identified information be matched with other datasets (including public ones) to re-identify individuals?

Decision Making and Impact

• Will the project make decisions that affect people? For example, determining eligibility for a benefit or service.
• Will it use automated decision-making? Does it use AI or analytics to inform policy, improve services, or make decisions?
• Will it impact the community? Could the project impact the community’s reasonable expectations of privacy?
• Will it be perceived as intrusive? Does it collect information in a way the community might consider intrusive (e.g., drones, biometrics, or camera surveillance)?

Sharing and Third Parties

• Will the project share personal information? Does it involve transferring information overseas, or providing it to the public or another agency?
• Does it involve a contracted service provider? Will a vendor or contracted provider handle personal information?

Security, Access, and Storage

• Will it change storage or security? Are there changes to how personal information is secured or stored?
• Will it change access for individuals? Does the project alter how individuals access their own information (e.g., by imposing costs)?
• Will it change how a person’s identity is verified? Is a new or amended identity verification process being used?

Monitoring and Compliance

• Will the project track individuals? Does it involve systematic monitoring, such as tracking geolocation or behavior?
• Does it involve legislative requirements? Are there new or changed legislative requirements regarding the collection, storage, use, or disclosure of personal information?

Additional Contextual Questions

A robust threshold assessment could include descriptive questions to give privacy practitioners a clearer picture of the risk landscape from departments that have answered yes to the above questions. Those might look like: 

• What data is involved? Be specific, particularly about the volume and type(s) of data. This helps assess the associated risk levels. 
• Describe the proposed processing: Does it involve innovative new technologies, data matching, or AI that results in automated decisions that may impact individuals?
• What third parties are involved? Who are the technology partners, service providers, or business partners involved in using the data for a new purpose? It is critical to identify if data will be shared, with whom, and for what specific purpose. Third parties represent a significant risk when it comes to data breaches. 

What are the next steps from the Threshold Privacy Assessment? 

The next step is to decide, based on the threshold assessment, whether a comprehensive Privacy Impact Assessment is required. Generally, if your team is going to start collecting, using or storing personal information in a new way that hasn’t previously been reviewed by your privacy team, then a full PIA is the next step. More on that here.

If, however, there is no personal information collection taking place or there are no proposed changes to existing information handling processes, then the next step is to store the threshold privacy impact assessment. It’s a good idea to ensure your teams are trained on the correct storage processes, so you have a thorough audit trail if needed. 

Things to be careful about

A major risk when it comes to threshold PIAs emerges when they’re treated as a one-and-done task within a project. Scope creep or project changes can easily happen that would mean a threshold PIA should trigger a more comprehensive privacy review, but that’s missed because the team ‘already completed a threshold PIA’. 

There are other risks too, including: 

• The Threshold PIA may not leave space for the team member completing it to outline how they are avoiding collecting personal information. This can leave a gap in the defensibility of your decisions if they’re later questioned by a regulator. 
• Your team. An organisation’s human resources are, and will likely remain, one of the key privacy risks. When it comes to your team, two significant risks at the threshold privacy impact assessment stage are 1) that they will ‘game’ the answers to avoid triggering more ‘paperwork’ or 2) they don’t understand the legal definition of personal information. Training and continuous reinforcement of the importance of privacy to your organisation can help to reduce these risks. 
• Supply chain blind spots: Many organisations make the mistake of assuming that outsourcing data processing or handling to a third-party vendor shifts the risk to that party. The Office of the Australian Information Commissioner is clear that organisations cannot outsource their privacy obligations to third parties, and that they should instead focus on working with the third parties to adequately protect personal information. 

Privacy Impact Assessments with Privacy 108

Our team offers a suite of services relating to Privacy Impact Assessments, from completing them for you to developing a process for your organisation to follow from threshold assessment through to a comprehensive review. 

Privacy108’s approach is holistic, contemplating a legal and IT perspective. It recognises that PIAs should not be undertaken on a one-size-fits-all basis. Instead, your Privacy 108 PIA considers your individual risk profile, timeline, budget, and IT infrastructure. 

For more information, reach out to the team for an obligation-free chat at hello@privacy108.com.au. 

You can learn more about PIAs in the following resources: 

• Triggers for Conducting a Privacy Impact Assessment
• PIAs as a Business Tool
• The AFP in Trouble Again for AI Use with no PIA.
• 3 Steps for Better PIAs.