What is a privacy impact assessment (PIA)?, Critical Analysis help

1) What is a privacy impact assessment (PIA)?

  According to the U.S. Department of Homeland Security, a privacy impact assessment or PIA, is a useful tool to “identify and mitigate privacy risks . . .” (Privacy Impact Assessments, 2015). A PIA may be requested by privacy advocate groups or by oversight committees when there is a potential for individual or public privacy to be put at risk. This risk can occur when a new law or procedure is introduced that may require personally identifiable information to be gathered. For example, a PIA was completed when the U.S. Secret Service introduced the use of Advanced Imaging Technology (Privacy Impact Assessment for the Secret Service Use of Advanced Imaging Technology, 2011). The assessment address concerns over where and how body scan images might be stored or viewed.

2) Name and briefly describe 3 best practices for federal government IT managers who are charged with preparing a PIA.

  The U.S. Department of Homeland Security lists three goals that should be accomplished when performing a PIA. The first goal should be to ensure that the task or action being assessed aligns with all legal policies for privacy. Secondly, the PIA should address all risks and potential effects of the action being assessed. Lastly, the assessment should “evaluate protections and alternative processes to mitigate potential privacy risks” (Privacy Impact Assessments, 2015).

3) Name and briefly describe 3 “worst” practices for protecting privacy of individuals whose information is collected, processed, transmitted, and stored in federal government IT systems and databases.

  The lack of “best” practices could be considered the “worst” practices to perform when the protection of individual privacy information is at stake. For example, not providing timely and frequent training and awareness for employees can lead to negative consequences such as a data breach. On the technical side, data that is not encrypted is especially at risk of being exposed should a data breach occur (Working to Prevent Internal Data Breaches, n.d.). These two “worst” practices, could create an opportunity for identity theft for the individual(s) who’s PII becomes exposed. A third “worst” practice could be failing to regularly assess risk for the systems and processes storing PII. Regular risk assessments are considered an essential part of a successful information security plan (NIST, 2014) so failing to do the assessments could be considered a “worst” practice.

References

NIST. (2014, April 1). FISMA – Detailed Overview. Retrieved from NIST.gov: http://csrc.nist.gov/groups/SMA/fisma/overview.html

Privacy Impact Assessment for the Secret Service Use of Advanced Imaging Technology. (2011, December 23). Retrieved from dhs.gov: https://www.dhs.gov/sites/default/files/publications/privacy_pia_usss_ait_0.pdf

Privacy Impact Assessments. (2015, August 24). Retrieved from dhs.gov: https://www.dhs.gov/privacy-impact-assessments

Working to Prevent Internal Data Breaches. (n.d.). Retrieved from idtheftcenter.org: http://www.idtheftcenter.org/Data-Breaches/working-to-prevent-internal-data-breaches.html

2) A privacy impact assessment is an “analysis of how personally identifiable information [PII] is collected, used, shared, and maintained” (Privacy Impact Assessments, n.d.).  The Department of Homeland Security lists the three main goals of a PIA as: ensuring conformity with laws and regulations, thoroughly determine risk and effects, and evaluate protection methods (Homeland Security, n.d).

  The Australian Government spells out ten key elements when preparing a PIA.  One of the elements/best practices is to perform a threshold assessment.  A threshold assessment establishes early on whether a PIA is necessary for each project.  If there is personal information involved it can be assumed a PIA is necessary (Guide to undertaking, 2014).  In their PIA practices guide the Department of Health and Human Services lists coordination as a best practice.  This sounds simple but it is very important for a successful PIA.  All parties involved need to be involved and coordinated/communicating in order to ensure a sufficient PIA is created (Practices Guide, 2008).  Another best practice is to periodically and perpetually update the PIA.  The PIA “is a living document that must be reviewed” and changed if necessary continually (Practices Guide, 2008).

  One worst practice of storing PII (Personal Identifiable Information) is storing it in plain text on the IT systems.  It is very important for PII to be encrypted to protect it from being easily stolen.  Another worst practice is to allow all individuals in the IT office to have access to the systems and databases containing the PII.  Only a few essential personnel should have full access to private personal information; this limits the unauthorized use or viewing of PII.  A non-technical worst practice would be editing/opening the files/systems on a computer screen that is visible to people who do not have access to the information.  This could result in unauthorized viewing of PII.

 References:

Privacy impact assessment. (n.d.). Federal Trade Commission. Retrieved from: https://www.ftc.gov/site-information/privacy-policy/privacy-impact-assessments

Privacy impact assessments. (n.d.). U.S. Department of Homeland Security. Retrieved from: https://www.dhs.gov/privacy-impact-assessments

Guides to undertaking privacy impact assessments. (May2014). Australian Government. Retrieved from: https://www.oaic.gov.au/agencies-and-organisations/guides/guide-to-undertaking-privacy-impact-assessments

Practices Guide. (25Jun2008). Department of Health and Human Services. Retrieved from: http://www.hhs.gov/ocio/eplc/EPLC%20Archive%20Documents/19%20-%20Privacy%20Impact%20Assessment/eplc_privacy_impact_assessment_practices_guide.pdf