Supporting Privacy Impact Assessments using Problem-based Privacy Analysis (Technical Report)

Several countries prescribe or advise government departments and organizations to perform a privacy impact assessment (PIA) if these prepare new projects or change existing ones that involve personal information. A PIA shall summarize what personal information is collected, processed, stored, and distributed in the context of the project. But there is only little support for undertaking a PIA and to create a PIA report, most countries only provide vague guidelines and simple templates. We present in this paper an extension of the problem-based privacy analysis (ProPAn) method that provides assistance to software developers for some steps of a PIA. We provide a formally specified method with welldefined steps and tool support to reduce the effort to be spent for conducting a PIA and to produce a more complete, coherent, and adequate PIA report.