A Proposed Privacy Impact Assessment Method Using Metrics Based on Organizational Characteristics

The assessment of the potential impact for an organization from a privacy violation incident is important for three main reasons: the organization will have a justified estimate of the cost (financial, reputation or other) that may be raised, will facilitate the selection of the appropriate technical, procedural and organizational protection mechanisms and also will be compliant with the new General Data Protection Regulation that will be in effect from May 2018. Today, there are several methods to do a Privacy Impact Assessment but none of these quantifies the results according to specific metrics and thus can be significantly affected by various subjective parameters. Furthermore, the specific organizational characteristics (size, activities, number of clients, type of offered services etc.) are very rarely accounted, a fact that also affects the accuracy of the results. In this paper, a privacy impact assessment method that explicitly takes into account the organizational characteristics and employs a list of well-defined metrics as input, is presented.