Evaluating privacy impact assessment methods: guidelines and best practice

Abstract

Purpose This paper aims to practically guide privacy impact assessment (PIA) implementation by proposing a PIA process incorporating best practices from existing PIA guidelines and privacy research. Design/methodology/approach This paper critically reviews and assesses generic PIA methods proposed by related research, data protection authorities and standard’s organizations, to identify best practices and practically support PIA practitioners. To address identified gaps, best practices from privacy literature are proposed. Findings This paper proposes a PIA process based on best practices, as well as an evaluation framework for existing PIA guidelines, focusing on practical support to PIA practitioners. Practical implications The proposed PIA process facilitates PIA practitioners in organizing and implementing PIA projects. This paper also provides an evaluation framework, comprising a comprehensive set of 17 criteria, for PIA practitioners to assess whether PIA methods/guidelines can adequately support requirements of their PIA projects (e.g. special legal framework and needs for PIA project organization guidance). Originality/value This research extends PIA guidelines (e.g. ISO 29134) by providing comprehensive and practical guidance to PIA practitioners. The proposed PIA process is based on best practices identified from evaluation of nine commonly used PIA methods, enriched with guidelines from privacy literature, to accommodate gaps and support tasks that were found to be inadequately described or lacking practical guidance.

On the Evaluation of Privacy Impact Assessment and Privacy Risk Assessment Methodologies: A Systematic Literature Review

“…To facilitate an understanding of the PIA process, as well as the core components that are essential for establishing a riskbased approach, we illustrate a generalized PIA process inspired by works from [21] and [30] in Fig. 1.…”

“…Given the context and purpose of processing personal data, a data controller can assess whether the processing will result in high risk; hence, a threshold analysis should be performed [31]. The threshold analysis provides an overview of whether a full-blown PIA process is necessary [30], [31]. If a PIA process is necessary, the system is comprehensively described to model its behavior and characteristics.…”

GDPR Interference With Next Generation 5G and IoT Networks

“…Privacy impact assessment (PIA) is a risk management approach which complement the privacy by design context [33] [34], evaluating the risk of every processing regarding to a specific initiative. PIA is necessarily carried out especially, in case of a (a) systematic and extensive evaluation of personal aspects (profiling), (b) existence of big data sensitive (Article 9) or (c) data about criminal convictions and offences (Article 10) and (d) a systematic monitoring of a publicly accessible area on a large scale.…”

A Perfect Match: Converging and Automating Privacy and Security Impact Assessment On-the-Fly

“…The paramount importance of privacy preservation, along with the establishment of the General Data Protection Regulation (GDPR) that governs the European territory, has rendered the privacy risk assessment a rapidly changing field, due to notable standardisation actions and legal establishments. However, a common language and a practical methodology that is flexible enough to address diverse privacy needs is still missing [10], while the community has identified the need for further research towards the implementation of tools to support Privacy Impact Assessment (PIA) conduction [12].…”

“…This is rather contradictory considering the NIST proposed guidelines [10], according to which, the data protection lies in the intersection of the cybersecurity and privacy risks. Therefore, the lack of sufficient tools and methodologies that can offer the PIA a level of automation [12], so that risk impact assessment can be extracted in a timely manner, but most importantly the lack of proper metrics that can steer the decisions of the assessor in identifying, prioritising, anticipating and, finally, mitigating the risks, could raise questions on the effectiveness of the tools and the thoroughness of the assessments. Indeed, the diversity and complexity of proposed privacy properties makes an informed choice of metrics rather challenging [13] and sets the challenge ahead on how to efficiently converge the usually contradicting security and privacy requirements, of a business ecosystem, towards a better risk assessment and estimation.…”