DPIA Screening - Performance Improvement Plan 2024-25
A Data Protection Impact Assessment (DPIA) is a process to help you systematically and comprehensively analyse your personal data processing and help you identify and minimise any data protection risks of a project.
You must do a DPIA before you begin any type of personal data processing that is “likely to result in a high risk.”
This set of screening questions will help you decide whether a DPIA is necessary. Please note, if there is a change to the nature, scope, context or purposes of your processing you will be required to complete this screening template again.
You will be accountable for the screening decisions you make. Therefore, it is critical that you document via “Explanatory Notes” the screening decisions you have made, providing logical reasons regarding whether to do a DPIA or not.
Section A - Project Details
Title of Project, Plan or Policy |
Performance Improvement Plan 24-25 |
---|---|
Is this an existing, revised or new project? |
Revised |
What is the purpose of the project, plan or policy? e.g. intended aims or outcomes Include any relevant background information here |
Duty to Improve Councils have a general duty to make arrangements to secure continuous improvement in the exercise of their functions (Local Government Action NI 2014). Improvement in the context of the Act means more than gains in service output or efficiency, or in internal effectiveness. Improvement means an activity that enhances the sustainable quality of life and environment for ratepayers and communities. For each financial year, councils must set Improvement Objectives, and have in place the arrangements to achieve them. These objectives must be framed to bring about improvement in at least one of the specified aspects of improvement outlined within the Act of strategic effectiveness, service quality, service availability, fairness, sustainability, efficiency, and innovation. Our Improvement Objectives Our Objectives for 2024-25 relate to improving our functions and services, and include: 1. People: We will work with partners to improve the lives of citizens. 2. Place: We will maintain and improve our local areas. 3. Planet: We will reduce our environmental impact and improve sustainability. Our plan also includes statutory indicators and standards, as specified by the Local Government (Performance Indicators and Standards) Order (NI) 2015 as well as any ongoing actions from previous year’s Performance Improvement Plans. Due to ongoing internal transformation activities, and high levels of external uncertainty, the actions described within the plan to deliver our objectives are subject to the availability of funding and finance throughout the year. 1. People - We will work with partners to improve the lives of citizens. By:
Why?
What you will see:
How we will measure improvement:
Strategic links: Programme for Government:
Community Plan:
Corporate Plan:
Aspect of Improvement:
2. Place - We will maintain and improve our local areas. By:
Why?
What you will see:
How we will measure improvement:
Strategic links: Programme for Government:
Community Plan:
Corporate Plan:
Aspect of Improvement:
3. Planet - We will reduce our environmental impact and improve sustainability By:
Why?
What you will see:
How we will measure improvement:
Strategic links: Programme for Government:
Community Plan:
Corporate Plan:
Aspect of Improvement:
|
Which MEABC Department owns or holds responsibility for this project, plan or policy? |
Ownership of this plan is Council wide. Each Improvement Objective is made up of a number of actions and measures, each with an assigned responsible officer. Overall responsibility for each Improvement Objective is assigned at Director level to Senior Responsible Officers (SROs), as detailed within the plan. The Corporate Performance & Improvement team will assume responsibility of reporting progress against the plan on a quarterly basis. |
Section B
Does this project, plan or policy involve the processing of personal data? |
No |
||
---|---|---|---|
This DPIA screening relates to the Performance Improvement Plan document at a strategic level. Any instances where personal data may be processed will come to fruition in the projects emanating from the Improvement Objectives. It will be the responsibility of the project SROs to ensure that a DPIA screening is carried out, if not already done so. If the answer to this question is ‘No’, you do not need to conduct a DPIA. Please proceed straight to Section E. If the answer to this question is ‘Yes’, please proceed to Section C. |
Section C: Questions 1 – 13
For questions 1 to 13, a DPIA MUST be carried out if the answer is YES. Your documentation should explain very clearly whether there are any indicators that a type of processing will likely result in high risk. See Appendix A for Information Commissioner’s Office (ICO) examples of processing “likely to result in high risk.”
For some of these questions, the answer will only be “yes” if the processing occurs in combination with criteria (see questions 14 to 22) in the Article 29 Data Protection Working Party’s European Guidelines.
|
Screening Questions – will the project: |
Yes/No |
Explanatory Notes |
---|---|---|---|
1 |
Use systematic and extensive profiling or automated decision-making to make significant decisions about people? |
|
|
2 |
Process special category data or criminal offence data on a large scale? |
|
|
3 |
Systematically monitor a publicly accessible place on a large scale? |
|
|
4 |
Use innovative technologies or the novel application of existing technologies? (Note: A DPIA is required where this processing is combined with any of the criteria from the European guidelines.) |
|
|
5 |
Use profiling, automated decision-making or special category data to help make decisions on someone’s access to a product, service, opportunity or benefit? |
|
|
6 |
Carry out profiling on a large scale? To decide what constitutes ‘large scale’ you should consider and include information on factors such as: -the number of individuals concerned -volume of data -variety of data -duration of processing -geographical extent of processing. Also see examples in ICO’s guidance of processing/projects they consider to be large scale. |
|
|
7 |
Process biometric data? (Note: A DPIA is required where this processing is combined with any of the criteria from the European guidelines.) |
|
|
8 |
Process genetic data? (Note: A DPIA is required where this processing is combined with any of the criteria from the European guidelines.) |
|
|
9 |
Combine, compare or match personal data from multiple sources? |
|
|
10 |
Process personal data without providing a privacy notice directly to the individual? (Note: A DPIA is required where this processing is combined with any of the criteria from the European guidelines.) |
|
|
11 |
Process personal data in a way which involves tracking individuals’ online or offline location or behaviour? (Note: A DPIA is required where this processing is combined with any of the criteria from the European guidelines.) |
|
|
12 |
Process children’s personal data for profiling or automated decision-making or for marketing purposes, or offer online services directly to them? |
|
|
13 |
Process personal data which could result in a risk of physical harm in the event of a security breach? |
|
|
Section D: Article 29 Data Protection Working Party’s European Guidelines
When considering if your processing is “likely to result in high risk,” you should consider the European guidelines.
These define nine criteria of processing operations likely to result in high risk. In most cases, a combination of two factors indicates the “need” for a DPIA.
Although this is not a strict rule.
Therefore, if the answer to any of questions 14 to 22 is “yes” a DPIA should be “considered.”
Your documentation should explain very clearly whether there any indicators that a type of processing will likely result in high risk.
See Appendix B for the Article 29 Data Protection Working Party’s examples of processing “likely to result in high risk.”
|
Will the project: |
Yes/No |
Explanatory Notes |
---|---|---|---|
14 |
Involve evaluation or scoring? |
|
|
15 |
Involve automated decision-making with legal or similar significant effect? |
|
|
16 |
Involve systematic monitoring? |
|
|
17 |
Involve sensitive data or data of a highly personal nature? |
|
|
18 |
Involve data processing on a large scale? |
|
|
19 |
Involve matching or combining datasets? |
|
|
20 |
Involve processing of data concerning vulnerable data subjects*? (Note: staff may be considered to be vulnerable data subjects due to the imbalance of power between employer and employee.) |
|
|
21 |
Use innovative technological or organisational solutions? |
|
|
22 |
Prevent data subjects from exercising a right or using a service or contract? |
|
|
Section E: Findings
Is a DPIA required?
No
Note: Data Protection legislation and Information Commissioner’s Office guidance state that you should seek your Data Protection Officer’s advice when you need to do a Data Protection Impact Assessment.
Final Comments
This DPIA screening relates to the Performance Improvement Plan document at a strategic level. Any instances where personal data may be processed will come to fruition in the projects emanating from the Improvement Objectives. It will be the responsibility of the project SROs to ensure that a DPIA screening is carried out, if not already done so.
DPIA Screening undertaken by: |
Business Planning & Performance Manager |
---|---|
Date Completed: |
24 April 2024 |
DPIA Screening approved by: |
Assistant Director of Citizen Focus |
---|---|
Date Completed: |
25 April 2024 |