A privacy impact assessment (PIA) identifies and evaluates the potential effects that a project, initiative, or proposed system or scheme may have on privacy. In general, it is best practice to conduct a preliminary PIA (PPIA) prior to starting a full PIA.
ATIPPA, 2015 requires departments and the executive branch of the provincial government to complete a PIA or PPIA during the development of a program or service. Further, if the PIA involves a common or integrated program or service, the minister must notify OIPC regarding this program at an early stage of development and it must submit the PIA to OIPC for the Commissioner’s review and comments.
While ATIPPA, 2015 does not require all public bodies to conduct PPIAs and PIAs, it is good practice to do so. In addition, while ATIPPA, 2015 does not require OIPC to review all PIAs, this Office welcomes the opportunity to review and provide comments on any PIA that a public body conducts.
Please see our guidance documents on this subject matter: