Report on PIA Best Practices

5. Conclusions

The PIA best practices session illustrated a strong endorsement of the benefits of the policy and the current TBS activities that provide proactive support to departments on PIA Policy and Guidelines implementation activities. Departments were very aware and supportive of the innovative ways that TBS has and plans to implement the PIA Policy and Guidelines.

The implementation of the Privacy Impact Assessment Policy and Guidelines is still in the early stages. When departments participating in the best practices sessions were asked to rate their department's integration of the PIA Policy requirements into day-to-day operations, on a scale of 1 (low) to 5 (high), most rated integration as 1 or 2.

There are many PIA reports under development. However, there are few examples of PIA reports that have completed the entire PIA process including the review with the Office of the Privacy Commissioner and follow-up on recommendations from the Privacy Commissioner.

The PIA process illustrated an overall need for privacy training in general. TBS identified this need during the development of the e-Learning Tool for the PIA process. The e-Learning tool is scheduled for implementation at the start of the 2003-2004 fiscal year and will contain a module devoted to privacy.

Timing of the PIA process is important because it may be difficult and/or expensive to retrofit privacy into the project late in the planning cycle. Departments will need to spend time once the PIA Report is complete to consider follow-up activities, monitor the implementation of privacy risk management measures and determine if project changes will lead to an update of the PIA Report.

Although the objective of the PIA process is risk management, departments receive ancillary benefits from the process that contribute to better information management practices. Since PIA implementation is in the early stages, in another 6 months TBS should have another session to build on these best practices in 2003/2004.