Privacy Impact Assessments - how much privacy is enough?

The talk starts by revisiting how security risk assessments work, using a fictional online merchant that stores card data with weak controls. The speaker walks through estimating likelihood and impact, deciding whether to accept, avoid, transfer or mitigate a risk, and measuring what remains. The core contrast follows: a privacy impact assessment keeps the same loop but puts the harm to individuals at the centre, while the organisation still makes the final decision.

The middle covers several invented scenarios, including a tracking-device platform that sells location-linked data to aggregators and a hiring service whose data may be requested by a foreign government. The fair information practice principles serve as the reference for privacy goals, and the speaker notes that laws name these assessments differently, so context matters. Problematic data actions and privacy harms are catalogued, from economic and reputational damage to psychological and autonomy harms, and controls range from Privacy by Design defaults to pseudonymisation and encryption.

The closing section looks at when to run an assessment, ideally early in development and whenever law requires it, and argues that AppSec practitioners can help with data mapping and privacy threat modeling while legal and risk teams own financial exposure. Legal questions are left to lawyers.