Article 33 of the European Commission’s proposed Data Protection Regulation would make privacy impact assessments (PIAs) mandatory for those data controllers whose processing operations present specific risks to data subjects (individuals).
The PIAF consortium sought the views of data protection authorities (DPAs) in the European Union on the specifics of a privacy impact assessment (PIA) policy. This paper describes the results of our survey as well as comments made by DPAs in the Article 29 Data Protection Working Party.
PIAF is the acronym for Privacy Impact Assessment Framework, a project carried out for the European Commission.
Among key policy-makers at the European and member state level—that is, the data protection authorities—there appears to be strong support for a PIA policy and for some key features. DPAs were virtually unanimous that the benefits of PIAs exceeded the costs or disadvantages, but have a diversity of views on many of the specifics of a PIA policy.