Introduction and criteria:
A data protection impact assessment (DPIA) is required when a form of processing of personal data, in particular when using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. This requirement is intended to ensure that potential risks are identified at an early stage and appropriate mitigation measures are taken. Here are the criteria explained in detail:
According to Article 35 GDPR:
- High risk: A DPIA is required if the processing is likely to result in a high risk to the rights and freedoms of data subjects. This applies in particular to processing operations which, by virtue of their nature, scope, context and purposes, are likely to result in a high risk.
- New technologies: The use of new technologies that could have an impact on data protection also requires a DPIA. Examples of this are technologies such as facial recognition, big data analytics or the Internet of Things (IoT).
- Extensive processing of special categories of personal data: This includes sensitive data such as health data, biometric data or data on racial and ethnic origin. Extensive processing of these data categories usually requires a DPIA.
Specific examples according to Recital 91 GDPR:
- Systematic and comprehensive evaluation of personal aspects: This includes processing operations aimed at systematically and comprehensively evaluating personal aspects relating to natural persons, in particular to analyse or predict aspects such as performance at work, economic situation, health, personal preferences, interests, reliability or behaviour.
- Automated decision-making, including profiling: Processing operations that may produce legal or similarly significant effects on data subjects, such as the automated rejection of an online credit application or the use of profiling for personalized advertising.
- Monitoring of publicly accessible areas: This concerns processing operations aimed at systematically and comprehensively monitoring publicly accessible areas, such as through video surveillance.
Prior consultation with the supervisory authority (Article 36 GDPR):
- Prior consultation: If a DPIA shows that, despite the mitigation measures envisaged, the processing would result in a high risk to the rights and freedoms of data subjects, the controller must consult the competent supervisory authority before starting the processing. The supervisory authority will then issue recommendations on how to mitigate the risk within a specified period of time.
Steps to determine the need for a DPIA:
- Identification of processing operations: First, all processing operations that are likely to present a high risk to the rights and freedoms of data subjects must be identified.
- Risk assessment: It must be assessed whether the identified processing operations involve a high risk. This may be done by assessing the nature, scope, context and purposes of the processing.
- Decision on the need for a DPIA: Based on the assessment, a decision is made as to whether a DPIA is necessary. If the processing is likely to result in a high risk, a DPIA must be carried out.
Examples of situations where a DPIA is required:
- Introduction of new technologies: A company plans to introduce a new facial recognition technology in its offices. A DPIA is conducted to assess the potential data protection risks and take measures to mitigate the risks.
- Comprehensive surveillance: A company installs a comprehensive video surveillance system in its office buildings. A DPIA helps to assess the risks to the privacy of employees and visitors and to implement appropriate measures to mitigate the risks.
Relevant articles of the GDPR:
- Article 35: Data protection impact assessment
- Article 36: Prior consultation
- Recital 91: Requirements and examples of the need for a DPIA
Summary:
A data protection impact assessment is required if the processing of personal data is likely to result in a high risk to the rights and freedoms of the data subjects. This applies in particular to the introduction of new technologies or the extensive processing of sensitive data. By identifying and assessing the risks at an early stage and implementing appropriate risk mitigation measures, it is ensured that the processing of personal data is carried out in accordance with data protection regulations and that the rights of the data subjects are protected. The DPIA is therefore an essential tool for ensuring compliance with the GDPR.
