City Privacy Impact Assessment Process - The Bronx
In The Bronx, New York, city agencies and contractors that plan or operate systems handling personal data should request a Privacy Impact Assessment (PIA) to document risks and protections. Start with the Department of Information Technology and Telecommunications (DoITT) guidance and your agency chief privacy or technology officer to confirm scope and required documentation. DoITT PIA guidance[1]
Overview
A PIA evaluates data flows, legal authority, retention, access controls, and mitigations for city systems that collect, store, or share personal information. In The Bronx, PIAs follow citywide policy and agency-level procedures; the responsible offices typically include the agency CIO, the agency privacy officer, and DoITT for technical review.
Penalties & Enforcement
Official city policy pages consulted do not specify civil fine amounts or statutory penalties tied directly to failing to request a PIA; monetary penalties are not specified on the cited page. Enforcement and compliance are generally handled at the agency level and through DoITT oversight where technical or contractual noncompliance is identified.
- Enforcer: Agency CIO or privacy officer, with DoITT technical review and oversight.
- Inspections and complaints: submit to your agency compliance office or DoITT security contact; see Help and Support / Resources below.
- Fines: not specified on the cited page.
- Court or administrative actions: not specified on the cited page.
Escalation and repeat offences
The cited guidance does not list escalation amounts or ranges for first versus repeat violations; escalation is typically administrative and may involve corrective plans, contractual remedies, or elevated review by agency leadership.
Appeals and review
- Appeal routes: not specified on the cited page; agencies may offer internal review procedures or direct inquiries to the Law Department for formal challenges.
- Time limits for appeal/review: not specified on the cited page.
Defences and discretion
- Permits, exemptions, or documented legal authority may affect PIA requirements; consult your agency counsel.
- Reasonable mitigation and documented remediation plans are commonly accepted as discretionary responses to identified risks.
Common violations
- Failure to complete a PIA before deploying a system that handles personal data.
- Incomplete data inventories or missing access controls.
- Insufficient retention or disposal policies for personal data.
Applications & Forms
The city PIA guidance page does not publish a standard public PDF form or fee schedule; agencies typically require documentation, data inventories, and threat assessments submitted to the agency privacy officer or DoITT as part of the review. For exact forms or submission portals, contact your agency privacy or IT office directly.
How to prepare a PIA request
Before submission, prepare a concise project summary, data inventory, intended data uses and disclosures, retention schedule, access controls, data-sharing agreements, and proposed mitigations for identified risks.
- Document required: project summary and data inventory.
- Security controls: list of technical and administrative safeguards.
- Timeline: expected deployment and review milestones.
FAQ
- Who must request a PIA?
- Any city agency or contractor proposing a system that collects, stores, processes, or shares personal information should request a PIA; check with your agency privacy officer to confirm applicability.
- How long does review take?
- The cited guidance does not provide a standard review timeline; timing depends on project complexity and agency processes.
- Are there fees?
- No public fee schedule for PIAs is published on the cited city guidance page.
How-To
- Identify the project owner and agency privacy officer and confirm whether a PIA is required.
- Prepare a data inventory, project summary, retention schedule, and proposed mitigations.
- Submit materials to your agency privacy officer and request DoITT technical review if required.
- Respond to follow-up questions, implement required mitigations, and document final approval or corrective actions.
- If denied or disputed, seek agency internal review or contact the Law Department for formal guidance.
Key Takeaways
- Start early: conduct a PIA before procurement or deployment.
- Document data flows and mitigations clearly for smoother review.
- Contact your agency privacy officer and DoITT for formal submission steps.
Help and Support / Resources
- City of New York - DoITT (Department of Information Technology & Telecommunications)
- City of New York Law Department
- NYC Open Data