The state of the art in privacy impact assessment

Abstract There is growing interest in Europe in privacy impact assessment (PIA). The UK introduced the first PIA methodology in Europe in 2007, and Ireland followed in 2010. PIAs provide a way to detect potential privacy problems, take precautions and build tailored safeguards before, not after, the organisation makes heavy investments in the development of a new technology, service or product. This paper presents some findings from the Privacy Impact Assessment Framework (PIAF) project and, in particular, the project's first deliverable, which analyses the similarities and differences between PIA methodologies in Australia, Canada, Hong Kong, Ireland, New Zealand, the United Kingdom and the United States, with a view to picking out the best elements which could be used in constructing an optimised PIA methodology for Europe. The project, which began in January 2011, is being undertaken for the European Commission's Directorate General Justice. The first deliverable was completed in September. The paper provides some background on privacy impact assessment, identifies some of its benefits and discusses elements that can be used in construction of a state-of-the-art PIA methodology.