Threshold privacy assessment

The first step in undertaking a privacy impact assessment (PIA) is to assess whether the project will benefit from a PIA. Not every project will need a PIA. A PIA will not be necessary if the project will not handle any personal information or the project does not propose any changes to existing information handling practices (and where the privacy impacts of these practices have been assessed previously and found to be appropriate).

The following questions will help you to determine whether you should undertake a PIA. If you answer ‘yes’ to any of the questions, your project will benefit from a PIA. Regardless of whether you proceed to a PIA, you should keep a record of the threshold assessment to document your decision.

For further assistance in conducting a PIA, please refer to the Office of the Information Commissioner’s guideline: Undertaking a Privacy Impact Assessment or one page summary.

Project name

Brief description of project

Outline what the project will deliver, what it will achieve, and who is responsible for the project.

Description of the information

Provide a brief description of the personal information that will be collected and handled (for example - name, date of birth, contact information, identity information, health information, financial details, etc).

Personal information is any information about an individual who is or can reasonably be identified.

Threshold privacy assessment

The checklist below will help you decide whether your project may have significant privacy implications. A PIA is recommended if you answer “Yes” to any of the following questions.

Will the project involve:	Yes	No
Collecting personal information or a new way of collecting personal information? (including from a new or existing source)	☐	☐
Using personal information to make decisions or take action against individuals in ways which can have a significant impact on them? (for example, whether to receive a service or benefit)	☐	☐
Collecting personal information in a way that might be perceived as being intrusive? (for example, camera surveillance, drones or biometric scans)	☐	☐
Using personal information already held by the agency for a purpose other than how it is currently used?	☐	☐
Disclosing personal information to another agency, a contractor, the private sector or to the public?	☐	☐
An exchange of personal information between agencies?	☐	☐
Engaging a contracted service provider to deal with personal information in any way for the agency? Or will the contracted service provider transfer personal information to the agency or provide services to a third party for the agency?	☐	☐
Linking, matching or cross-referencing of personal information across or within the agency?	☐	☐
Using personal information for research or statistics?	☐	☐
A new or changed way of transferring personal information between agencies or between an agency and another entity?	☐	☐
New or changed legislative provisions that impact how the agency will collect, use or disclose personal information?	☐	☐
A new way or increased costs for individuals to access their own personal information?	☐	☐
A change in the way personal information is stored or secured? (for example, a cloud-based storage system)	☐	☐
A new or amended process for verifying an individual’s identity?	☐	☐
Transferring personal information outside Australia at any stage? (for example, publishing information to a website or through use of cloud-based services or online surveys)	☐	☐
Using de-identified information that could be matched with another dataset (or publicly available information) and enable individuals to be identified?	☐	☐
Any other activity that could impact on the community’s reasonable expectations of privacy? If yes, please detail:	☐	☐

Project manager

I recommend that a Privacy Impact Assessment [ is / is not ] needed for this project.

Prepared by:
Position:
Email:	Telephone:
Date:

Privacy Officer (optional)

I [ support / do not support ] that a Privacy Impact Assessment [ is / is not ] needed for this project

Name:
Position:
Email:	Telephone:
Date:
Comments:

Project Executive/Steering Committee/senior management:

I have reviewed the information provided in this threshold assessment and I [ agree / do not agree ] that a privacy impact assessment [ is / is not ] needed for this project.

Name:
Position:
Signature	Date:
Comments:

The term ‘project’ is used broadly. It is intended to cover the full range of activities and initiatives that may have privacy implications, such as new legislation or policies, an information sharing initiative, or new systems for storing or accessing personal information.