Which of the following should be the FIRST consideration when conducting a privacy impact assessment (PIA)?