That's partly why I encourage you to make it a legal obligation to conduct PIAs and to include the purpose and content of those assessments in the act.
There's a real risk here. In many cases I've seen, the assessments were a purely mechanical exercise, and that serves no purpose. The aim is to ensure that programs and activities are designed to respect privacy and that privacy is a fundamental right. The idea behind an assessment is to be proactive.