Interviews find uneven PIA and DPIA practice after the GDPR
Original title: The State of the Practice in Privacy Impact Assessments: Understanding the Professionals' Perspectives, Experiences, and Current Procedures
Twenty-six privacy professionals in 17 countries describe low DPIA-method adherence, neglected data-subject interests, and assessment fatigue.
Researchers interviewed 26 privacy professionals across 17 countries about how they plan and run privacy and data protection impact assessments. Using reflexive thematic analysis, they report low adherence to established DPIA methods, differences between PIAs and DPIAs, and a perceived neglect of data subjects’ interests. Participants also discussed building fundamental-rights assessments on DPIAs and holistic assessments, while warning of assessment fatigue and links to the EU AI Act.
- The study used semi-structured interviews and reflexive thematic analysis.
- Participants came from 17 countries.
- Findings include low adherence to established DPIA methodologies.
- Professionals discussed FRIAs built on DPIAs and the EU AI Act.
- Holistic assessments raised concern about assessment fatigue.
From the original article
1 min read at arxiv.orgOrganisations frequently utilise Privacy Impact Assessments (PIAs), Data Protection Impact Assessments (DPIAs), or even Fundamental Rights Impact Assessments (FRIAs) to identify and evaluate potential risks and possible infringements of fundamental rights.
By Samuel Wairimu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.