substantial in its impact on society. It might for example contribute to a loss of personal autonomy or dignity or exacerbate fears of excessive surveillance. The outcome of a PIA should be a minimisation of privacy risk. 6. The Benefits of a PIA The Information Commissioner’s Office (ICO) promotes PIAs as a tool which will help organisations to comply with their DPA obligations, as well as bringing further benefits. Whilst a PIA is not a legal requirement (except risk processing i.e. ‘high safeguarding data), the ICO may often ask an organisation whether they have carried out a PIA. It is often the most effective way to demonstrate to the ICO how personal data processing complies with the DPA. More generally, consistent use of PIAs will increase the awareness of privacy and data protection issues within the School and ensure that all relevant staff involved in designing projects think about privacy at its earliest stages. Examples of a PIA would be appropriate A new IT system for storing and accessing personal data. A data sharing initiative where two or more schools seek to pool or link sets of personal data. A proposal to identify people in a particular group or demographic and initiate a course of action. Using existing data for a new and unexpected or more intrusive purpose. A new database which consolidates information held by separate parts of the school. Legislation, policy or strategies which will impact on privacy through the collection or use of information, or through surveillance or other monitoring. Cloud hosted applications. The collection of new data on an existing system. PIA Procedure The format for an initial PIA is at Annex A. This review form is on the eight Data Protection Principles described in Schedule 1 of the Data Protection Act. In the event that a full PIA is deemed appropriate the format for this is at Annex B The links between the PIA and DPA are set out in Annex C
substantial in its impact on society. It might for example contribute to a loss of personal autonomy or dignity or exacerbate fears of excessive surveillance. The outcome of a PIA should be a minimisation of privacy risk. 6. The Benefits of a PIA The Information Commissioner’s Office (ICO) promotes PIAs as a tool which will help organisations to comply with their DPA obligations, as well as bringing further benefits. Whilst a PIA is not a legal requirement (except ‘high risk processing i.e. safeguarding data), the ICO may often ask an organisation whether they have carried out a PIA. It is often the most effective way to demonstrate to the ICO how personal data processing complies with the DPA. More generally, consistent use of PIAs will increase the awareness of privacy and data protection issues within the School and ensure that all relevant staff involved in designing projects think about privacy at its earliest stages. Examples of a PIA would be appropriate A new IT system for storing and accessing personal data. A data sharing initiative where two or more schools seek to pool or link sets of personal data. A proposal to identify people in a particular group or demographic and initiate a course of action. Using existing data for a new and unexpected or more intrusive purpose. A new database which consolidates information held by separate parts of the school. Legislation, policy or strategies which will impact on privacy through the collection or use of information, or through surveillance or other monitoring. Cloud hosted applications. The collection of new data on an existing system. PIA Procedure The format for an initial PIA is at Annex A. This review form is on the eight Data Protection Principles described in Schedule 1 of the Data Protection Act. In the event that a full PIA is deemed appropriate the format for this is at Annex B The links between the PIA and DPA are set out in Annex C
school-privacy-impact-assessment-procedures.docx