Data protection impact assessments

The council has undertaken to take appropriate steps to protect the privacy of individuals. In particular, before we start to handle personal information for a new purpose or make changes to the existing way that we already handle information, we must carry out a data protection impact assessment (DPIA) at the earliest possible stage in the planning process.

It is a legal requirement to carry out a DPIA in relation to any changes to the processing arrangements in relation to personal data, special category personal data and personal data relating to criminal offences and convictions and which give rise to high levels of risks to the rights and freedoms of members of the public.

Obviously, we only need to carry out a DPIA if a project involves the use of private information about individuals. There is no need to carry out a DPIA for any other projects.

What is a DPIA?

A DPIA replaces the previous council requirements in relation to carrying out a Privacy Impact Assessment (PIA). The difference is that a PIA considered governance issues such as compliance with council powers and duties and the law such as human rights legislation and the common law duty of confidentiality. These matter should be considered in relation to their relevant impact assessment. A DPIA helps to identify risks in relation to data protection issues, anticipate problems and propose solutions. It is a self-assessment process for evaluating a proposed project: to identify its potential effects upon data protection compliance to ensure that the project complies with the data protection principles and to consider how any negative effects might be overcome.

The Information Commissioner has issued the Conducting Privacy Impact Assessments Code of Practice. In turn, the council's Information Governance Board (the IGB) has issued guidance for employees to carry out PIAs.

Council guidance

In relation to all processes involving the collection, use or handling of personal information, the council requires that you complete Sections 1 and 2 of the PIA template. Once you have done this, the Data Protection Impact Assessment guidance provides some screening questions which would allow Resources to decide whether a DPIA is necessary. These questions are the same as those used for the PIA process. It also explains some of the considerations in relation to identifying, evaluating and so far as possible mitigating/resolving any privacy risks arising from a relevant project.

The guidance makes it clear that a DPIA is not a snapshot or a one-off step in the process. As projects develop, there will be changes made to what is intended. All changes to a project involving the handling of private personal information must be considered to see whether they affect the DPIA and, if need be, the existing DPIA expanded to include or another DPIA in relation to those changes undertaken.

At the end of the DPIA process, the Resource concerned will be able to produce a report based upon the outcome of the DPIA and steps to be taken to mitigate data protection compliance risks. The elements to be contained within the assessment as set out in the guidance.

If there have been changes made to the project which affect the DPIA, the Resource must review the assessment produced in relation to the DPIA and update it to reflect any changes made or to be made such as additional data protection risks identified and the steps taken to mitigate those risks or risks which are no longer identified as being relevant.

Ultimately, on the completion of the project implementation, the Resource must update the assessments to show what steps have been implemented to mitigate privacy risks.

However, you must keep in mind that the DPIA is the basis for any decision to make changes or to introduce new ways or purposes for the gathering etc. of personal information. Consequently, all project plans must include sufficient time to permit a full and proper DPIA to be completed (including before the issuing on any tender documentation where the processing is part of a contract for the provision of services on behalf of the council.

Who is responsible for carrying out a PIA?

The primary responsibility to ensure that all DPIAs are carried out and completed where necessary lies with the Executive Director of the Resource concerned. However, on a practical basis, all Heads of Services in the Resources must ensure that their Service has assessed whether a DPIA is required, whether it has been carried out and all actions taken as a result of that assessment is part of all project management arrangements.

The governance arrangements introduced by the council includes consultation with its council's Data Protection Officer and the seeking of their advice or comments. However, the responsibility for the contents of the DPIA lies with the Resource carrying it out.

Further information

For further information see the Data protection impact assessment guidance document.