What Is a Personal Information Impact Assessment and Why Does It Matter?
Every day, organisations collect and process personal information. Whether it’s a visitor signing into a business park, a resident entering an estate, or an employee accessing a secure building, personal information forms part of many everyday operational processes.
But introducing a system or process that handles personal information shouldn’t only be about whether the technology works. There is another important question organisations need to consider:
“Have we assessed the privacy risks?”
That’s where a Personal Information Impact Assessment, or PIIA, comes in.
What is a Personal Information Impact Assessment?
A Personal Information Impact Assessment is a structured process used to identify and assess the privacy risks associated with the processing of personal information.
It helps an organisation understand what information is being collected, why it is needed, how it will be used, where potential risks may exist and what safeguards are in place to protect it.
Rather than waiting for a privacy concern, complaint or compliance issue to arise, a PIIA encourages organisations to consider these questions upfront and make informed decisions about how personal information is processed.
Why does your organisation need a PIIA?
Processing personal information comes with responsibility.
Under POPIA, organisations are expected to take appropriate steps to protect the personal information they process and ensure that adequate measures are in place. A PIIA forms an important part of understanding whether those measures are appropriate.
A thorough assessment can help an organisation:
Identify privacy risks before they become problems.
Understand what personal information is being collected and why.
Assess who has access to that information.
Review how information is stored, protected and retained.
Identify areas where additional safeguards may be required.
Demonstrate that privacy has been considered as part of organisational decision-making.
Support wider POPIA compliance efforts.
For organisations using access control, visitor management, CCTV, facial recognition, number plate recognition or other technologies involving personal information, these considerations can become particularly important.
What should a PIIA cover?
There isn’t necessarily a single set of questions that will suit every organisation or every processing activity. A useful PIIA should reflect how personal information is actually handled within the organisation.
As a starting point, it should consider areas such as:
The information being processed
What personal information is being collected or used? Does this include identification details, contact information, vehicle information, images or biometric information?
The purpose for collecting it
Why is the information required, and is the purpose clearly defined?
How the information is collected
Where does the information come from, and how does it enter the organisation’s systems or processes?
Who has access to it
Which employees, service providers, operators or other parties can access the information?
How it is stored and protected
What technical and organisational safeguards are in place to protect the information from loss, unauthorised access or unlawful processing?
How long it is retained
Is the information being kept for an appropriate period, and what happens when it is no longer required?
The risks to individuals
What could happen if the information were accessed, disclosed, changed, lost or used incorrectly?
The measures used to reduce those risks
What controls are already in place, and are additional measures required?
The aim is not simply to complete a document. It is to understand the processing activity and determine whether the risks have been appropriately considered and addressed.
A PIIA shouldn’t be a once-off exercise
Completing a PIIA and filing it away indefinitely defeats much of its purpose. Technology changes. Processes change. New integrations are introduced. Information may be used differently, new service providers may become involved, and new risks may emerge.
That means an organisation should revisit its assessment when there are meaningful changes to the way personal information is processed.
For example, a review may be appropriate when:
A new system or technology is introduced.
An existing system gains new functionality.
New categories of personal information are collected.
Information starts being shared with additional third parties.
Retention or access processes change.
New privacy or security risks are identified.
The organisation significantly changes the way a process operates.
Keeping the assessment relevant is just as important as completing it in the first place.
It’s more than ticking a compliance box
A PIIA should not be viewed as another document that simply needs to be completed for compliance purposes. Done properly, it gives an organisation an opportunity to understand its own information-processing practices, identify potential weaknesses and make better decisions about how personal information is handled.
It also creates a clearer record of the thinking behind those decisions. Privacy risks can differ significantly between organisations, technologies and processing activities, which is why a generic document can only ever go so far.
Where an organisation is unsure about how to conduct a PIIA, needs to develop one from the ground up, or wants an existing assessment reviewed, it may be worthwhile involving a qualified POPIA, privacy or compliance specialist, or the organisation’s legal team. The objective should be a PIIA that reflects what is actually happening within the organisation, not simply a completed form.
Responsible processing starts with understanding the risk.
Before introducing or changing a process that handles personal information, make sure privacy is part of the conversation from the beginning.
For all Access Control related information, contact ATG Digital by calling 010 500 8611, WhatsApp 072 055 1187, email sales@atthegate.biz or go to www.atgdigital.biz
Comments