Should privacy impact assessments be mandatory?

Communications of the ACM

Volumn 54, Issue 8, 2011, Pages 121-131

  Wright, David ^a  

^a Trilateral Research and Consulting LLP: Trilateral Research Ltd   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

IMPACT ASSESSMENTS;

RISK MANAGEMENT;

PLANNING;

EID: 77955619458     PISSN: 00010782     EISSN: 15577317     Source Type: Journal    
DOI: 10.1145/1978542.1978568     Document Type: Article

References (25)

1. Bamberger, K.A. and Mulligan, D.K. Privacy decisionmaking in administrative agencies. University of Chicago Law Review 75, 1 (Jan. 2008), 75-107.
2. Bennett, C.J. Privacy Impact Assessments: Jurisdictional Report for the United States of America, Annex D of Privacy Impact Assessments: International Study of their Application and Effects, study performed for the U.K. Information Commissioner's Office, October 2007; http://uat. ico.gov.U.K./upload/documents/ library/corporate/research-and-reports/lbrouni-piastudy-appd-us-2910071.pdf
3. Bennett, C.J. and Raab, C.D. The Governance of Privacy: Policy Instruments in Global Perspective, MIT Press, Cambridge, MA, 2006.
4. Clarke, R. Privacy impact assessment: Its origins and development. Computer Law and Security Review 25, 2 (Feb. 2009), 123-135.
5. Elliott, F. Safety fears over new register of all children. The Times, (Aug. 27, 2007); http://www.timesonline.co.U.K./tol/news/politics/ article2332307.ece
6. Eurobarometer, Dat Protection in the European Union-Citizen perceptions, Flash Report 225, February 2008; http://ec.europa.eu/public-opinion/archives/ flash-arch-en.htm
7. European Commission, Recommendation on the implementation of privacy and data protection principles in applications supported by radio-frequency identification, C(2009) 3200 final, Brussels (May 12, 2009).
8. European Parliament and Council, Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (Dec. 18, 2000); http://wwweuroparl.europa.eu/tools/disclaimer/documents/l- 00820010112en00010022.pdf
9. European Parliament and the Council, Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Brussels (Oct. 24, 1995); http://ec.europa.eu/justice- home/fsj/privacy/docs/95-46-ce/dir1995-46-part1-en.pdf
10. House of Lords Select Committee on the Constitution, Surveillance: Citizens and the State, Vol I: Report, The Stationery Office Limited, London (Feb. 6, 2009; http://www.parliament.the-stationeryoffice.com/pa/ld200809/ ldselect/ldconst/18/1802.htm
11. Information Commissioner's Office (ICO), Privacy Impact Assessment Handbook, Version 2.0, June 2009; http://www.ico.gov.U.K./for-organisations/ topic-specific-guides/pia-handbook.aspx
12. International Organization for Standardization, ISO 22307:2008: Financial services-Privacy impact assessment, Geneva (Apr. 16, 2008); http://www.iso.org/iso/iso-catalogue/catalogue-tc/catalogue-detail.htm?csnumber= 40897
13. Leyden, J. U.K. data breach incidents on the rise. The Register (July 2009); http://www.theregister.co.U.K./2009/07/09/data-breach-survey/
14. New Zealand Office of the Privacy Commissioner, Privacy Impact Assessment Handbook, June 2007; http://www.privacy.org.nz/privacy-impactassessment- handbook
15. Office of the Privacy Commissioner of Canada (OPC). Assessing the Privacy Impacts of Programs, Plans, and Policies, Ottawa, October 2007; www.privcom.gc.ca
16. O'Harrow, Jr., R. No Place to Hide, Free Press, New York, 2005.
17. Paton, G. Children's database ContactPoint launched despite security fears. The Telegraph, (Jan. 26, 2009); http://www.telegraph.co.U.K./news/ newstopics/politics/4338712/Childrens-database-ContactPointlaunched-despite- security-fears.html
18. Pfanner, E. Data leak in Britain affects 25 million. The New York Times, (Nov. 22, 2007); http://www.nytimes.com/2007/11/22/world/europe/22data.html?hp
19. Thomas, R. Speech to RSA Conference Europe on data breaches, Information Commissioner's Office, (Oct. 29, 2008); http://www.ico.gov.U.K./about-us/news- and-views/press-releases.aspx?year=2008
20. Thomas, R. and Walport, M. Data Sharing Review Report, (July 11, 2008); www.justice.gov.U.K./docs/data-sharing-review-report.pdf
21. Treasury Board Secretariat of Canada, Privacy Impact Assessment Guidelines: A framework to Manage Privacy Risks, Ottawa, (Aug. 31, 2002); http://www.tbs-sct.gc.ca/pubs-pol/ciopubs/pia-pefr/paipg-pefrld1-eng.asp
22. U.K. Cabinet Office. Data Handling Procedures in Government: Final Report, London, June 2008. http://www.cabinetoffice.gov.U.K./reports/data- handling.aspx
23. U.K. Performance and Innovation Unit, Privacy and Data-Sharing: The Way Forward For Public Services, Cabinet Office, London, April 2002; http://www.cabinetoffice.gov.U.K./strategy/work-areas/privacy.aspx
24. Warren, A. et al. Privacy Impact Assessments: International experience as a basis for U.K. Guidance. Computer Law and Security Report 24, (2008), 233-242. (Pubitemid 351698024)
25. Westin, A.F. Privacy and Freedom, Atheneum, New York, 1967.