Avoiding Common Mistakes in Privacy Impact Assessments
Learn how to navigate Privacy Impact Assessments effectively by avoiding common pitfalls such as perceiving PIAs as mandatory, not adapting questions, focusing on the wrong stakeholder, treating PIA as a task, and mixing cause and effect. Emphasize user-centric approaches and the importance of privacy-friendly systems.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
PIAs in Practice Designing for Privacy Tobias Pulls CC-BY-4.0
Source and Inspiration Based in large part on Privacy Impact Assessment in Practice by Jeroen van Puijenbroek and Jaap-Henk Hoepman
1. Perceiving PIAs as Mandatory PIAs are not mandatory, DPIAs only in particular cases May lead to PIA fatigue
2. Not Adapting Questions Same questionnaire for assessing data processing Different needs for different activities Should first perform a light-weight PIA to determine if full PIA is necessary
3. Focus on the Wrong Stakeholder Organisation-centric, to avoid fines Should be user-centric, and consult users as part of PIA
4. PIA as a Task Treating PIA as a one-time task early in development Revised years after first creation PIA is a process, not a task
5. Mixing Cause and Effect Reputation damage, fines, lawsuits Organisation risks Effect Layers of privacy risk Loss of trust in organisation Infringement of personal life of users Cause User privacy risks Inspired by Figure 2 in Privacy Impact Assessment in Practice by Jeroen van Puijenbroek and Jaap-Henk Hoepman
Conclusions Five common mistakes 1. Perceiving PIAs as mandatory 2. Not adapting questions 3. Focus on the wrong stakeholder 4. PIA as a task 5. Mixing cause and effect Being organisation-centric instead of user- centric PIAs (at best) data protection compliance no privacy-friendly systems Focus on avoiding risks, not only mitigating
