Key Takeaways: Chapter 28 -- Privacy Impact Assessments and Ethical Reviews

Core Takeaways

1. Assessments are diagnostic tools, not compliance exercises. A PIA or DPIA conducted genuinely forces an organization to confront the ethical implications of its data practices -- surfacing risks, consent gaps, proportionality failures, and fairness concerns that informal awareness misses. VitraMed's DPIA revealed issues that leadership had not previously confronted. The value is in the organizational learning, not the document.

2. PIAs are ethically required even when not legally mandated. GDPR Article 35 specifies when DPIAs are legally required. But the chapter argues that a PIA is ethically required for any significant data processing. "The law tells you when you must assess. Ethics tells you when you should assess." Organizations that limit assessments to legal mandates leave their most significant ethical risks unexamined.

3. Necessity and proportionality are the foundation of every assessment. Before evaluating risks, an assessment must answer: Is this processing necessary for the stated purpose? Could the same goal be achieved with less data, less intrusion, or no personal data at all? Is the scope of processing proportionate to the benefit sought? The UK Court of Appeal's ruling on facial recognition established that these tests must be genuinely applied, not merely acknowledged.

4. Risk acknowledgment without proportionate mitigation is performative. The Bridges ruling established that a DPIA that identifies risks and proposes inadequate mitigations is legally insufficient. Genuine assessment requires that mitigations be commensurate with the risks identified. "Operator training" is not a proportionate response to systemic algorithmic bias.

5. Algorithmic Impact Assessments extend the assessment framework to cover AI-specific risks. Traditional PIAs and DPIAs focus on data processing. AIAs address the distinct risks of algorithmic decision-making: bias, opacity, autonomy constraints, accountability gaps, and drift. The Canadian AIA framework provides a model for classifying algorithmic systems by impact level and calibrating requirements accordingly.

6. Threshold tests and proportionality prevent assessment fatigue and avoidance. Not every data practice requires a full-scale assessment. Threshold screening identifies which practices warrant detailed review. Proportionality calibrates the depth of review to the level of risk. Together, they prevent two failure modes: trivializing assessments (by requiring the same review for everything) and circumventing assessments (by making the process so burdensome that teams avoid triggering it).

7. Academic IRBs and corporate ethical review serve similar functions but differ structurally. IRBs have legal mandates, structural independence, binding authority, and external oversight. Corporate ethical review is generally voluntary, internal, advisory, and self-regulated. The translation from academic to corporate context remains incomplete, and several high-profile failures demonstrate the consequences.

8. Community consultation must be meaningful, not perfunctory. An assessment's stakeholder consultation section cannot be satisfied by general surveys or passive notice. For processing that disproportionately affects specific communities, meaningful consultation requires targeted engagement with those communities and genuine incorporation of their concerns.

9. Assessments must be iterative, not one-time. Algorithmic systems change over time. Data is updated. Conditions shift. Populations evolve. An assessment conducted at launch becomes stale within months. Effective assessment requires ongoing monitoring and periodic re-assessment -- a requirement that most organizations have not yet operationalized.

10. The DPIA process made VitraMed's power asymmetry visible. VitraMed collected data from patients who trusted their clinicians, processed it in ways patients did not know about, and shared results with parties patients did not choose. The DPIA did not create this asymmetry -- it made it visible. Visibility is the precondition for accountability.

Key Concepts

Key Debates

1. Should DPIAs be publicly available? Transparency argues for publication: affected communities and regulators should be able to evaluate the organization's analysis. Commercial confidentiality argues against: DPIAs may contain competitive information or security-relevant details. Where should the balance fall?

2. Are self-assessments inherently compromised? Can organizations honestly evaluate their own data practices? The DPIA is a self-assessment tool -- the organization evaluates its own processing. Does this create an inherent conflict of interest that undermines the assessment's value?

3. Should technology companies be legally required to maintain IRB-equivalent review boards? The structural advantages of IRBs (legal mandate, independence, binding authority, external oversight) are absent in corporate ethics review. Would mandating IRB equivalents for large technology companies improve ethical outcomes?

4. Is algorithmic impact assessment sufficient without external audit? The Canadian AIA and similar frameworks rely primarily on organizational self-assessment. For the highest-impact systems, should independent external audit be mandatory?

5. How should proportionality be applied when potential harm is severe but uncertain? The precautionary principle suggests erring on the side of caution. But precaution can paralyze innovation. How should assessments handle high-severity, low-probability risks?

Applied Framework: Five Questions of Assessment

When evaluating any data processing activity, apply these five questions:

These five questions do not replace a formal assessment. They provide a quick diagnostic that any practitioner can apply to any data practice at any stage of development.

Looking Ahead

Chapter 28 introduced the assessment processes that organizational infrastructure supports. Chapter 29, "Responsible AI Development," moves from assessing existing practices to building AI systems responsibly from the start. We will examine responsible AI frameworks, model cards (Mitchell et al., 2019), datasheets for datasets (Gebru et al., 2021), red-teaming methodologies, and deployment monitoring -- and introduce the ModelCard Python dataclass that makes AI documentation programmable. VitraMed will create its first model card for the clinical prediction model that the DPIA just assessed.

Use this summary as a study reference and a quick-access card for key vocabulary. The Five Questions of Assessment framework will recur in every remaining chapter.