A privacy impact assessment is an examination of how a programme handles personal information, the resulting privacy risks and the measures used to address them. An algorithmic impact assessment examines the effects of using an automated system to make or support decisions.
The same project can supply evidence to both assessments. The distinction is the question applied to that evidence: whether the information practices protect privacy, and what consequences follow from automating the decision.
Different assessment outputs
In Canada’s federal process, a privacy impact assessment, or PIA, produces a report connecting information practices, privacy compliance, risks and mitigation measures. The federal Algorithmic Impact Assessment, or AIA, uses a scored questionnaire to assign one of four impact levels. That level informs the requirements applied to the automation project.
The PIA’s analysis and the AIA’s classification are different outputs. Neither should be reduced to a badge attached to the model. Both concern the system’s use within a programme, including its data and effects on people.
One project, two sets of questions
Take a benefits service that uses application records to propose which cases need additional checks. The privacy analysis examines the information collected, its purpose, who receives it and how long it remains available. The automation analysis examines how the proposed routing affects applicants and the decisions made about them.
A routing error can delay an applicant’s case even when access to the records is tightly controlled. Conversely, an accurate routing result does not justify sending the applicant’s information to an unrelated recipient. Accuracy and appropriate information handling solve different parts of the problem.
Change the example so that the same records support an internal search tool rather than case routing. The information remains personal, but the tool’s role in decisions has changed. Change only the hosting arrangement and the decision function remains fixed while the organizations handling the information change. Assessment scope follows those mechanisms rather than the label AI.
Reusing evidence without merging conclusions
A common system description can identify the data sources, processing stages, vendor access and human actions. Reusing that description reduces contradictory accounts of the same deployment. Each assessment still needs conclusions that answer its own questions.
For a shared claim such as human approval before a case is routed, the description must identify where approval occurs. If one assessment describes a proposed gate while the other describes an already automated route, the project has two incompatible accounts of its operation.
Assessment versions therefore need to correspond to the same deployment. A change to data recipients calls for a privacy review; a change to the decision supported calls for reconsideration of the automation analysis. A change affecting both requires both accounts to be reconciled.
Assessment and approval
Sending a PIA to the Office of the Privacy Commissioner does not obtain its endorsement. The OPC provides review and recommendations; the institution owns internal approval and acceptance of residual risk. OPC guidance, Approval phase.
An AIA score likewise describes the result of an assessment procedure, rather than measured proof that no harm will occur. The operational question remains whether the controls described in the assessments exist, apply to the deployed version and address the risks identified.