What Action Requires Privacy Impact Assessment