[James_Firth]

Originally Posted by JohnHorb

One thing that I'm not clear on here - is there any obligation on Phorm to actually publish the final PIA in full? Presumably, as they have commissioned it, they will own the copyright?

The ICO don't go so far as to say MUST be published, but strongly hint that it should be.

http://www.ico.gov.uk/upload/documen...26-report.html

A PIA Report should be written with the expectation that it will be published, or at least be widely distributed. If so, the report can fulfil the functions listed above: accountability, post-implementation review, audit, input into future iterations of the PIA, and background information for people conducting PIAs in the future.

Some of the information gathered during a PIA process may be subject to security or commercial sensitivities. In such cases, it may be appropriate for the detailed information to be in confidential, or closed, appendices. Such information suppression, however, needs to be limited to only that which is justified. Sufficient information needs to be included within the PIA Report to ensure that the arguments and assessments are complete, informative and comprehensible