Short Reads

Countdown 8 weeks until GDPR : Will organizations be required to undertake Privacy Impact Assessments when conducting personal data processing?

Stibbe - Will organizations be required to undertake DPIA?

Countdown 8 weeks until GDPR : Will organizations be required to undertake Privacy Impact Assessments when conducting personal data processing?

29.03.2018 EU law

Only 8 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will organizations be required to undertake Privacy Impact Assessments when conducting any kind of personal data processing?

Privacy Impact Assessments or Data Protection Impact Assessments (“DPIA”) are only required in the exceptional situation in which the processing is likely to result in a high risk to the rights and freedoms of natural persons. Whether the processing entails such a high risk will depend on the presence of one or more of the following factors: automated decision-making, evaluation or scoring, systematic monitoring, sensitive data, scale of processing, vulnerable data subjects, data transfers outside the EU, etc. In particular, a DPIA will be required if the processing entails: (i) any systematic and extensive evaluation of personal aspects of natural persons based on automated processing or profiling upon which decisions are based; (ii) processing of so-called “sensitive” categories of personal data on a large scale; or (iii) a systematic monitoring of a publicly accessible area on a large scale. National supervisory authorities are moreover required to establish a list of the types of processing operations that require a DPIA, which is what Belgium has already done, for example.

Conversely, a DPIA is not required if the processing is not likely to result in a high risk. Moreover, other scenarios in which a DPIA is not required are (i) if a DPIA has already been carried out for very similar processing activities or (ii) if the processing has a legal basis under EU law or Member State law and a DPIA has already been carried out as part of a general impact assessment in the context of the adoption of that legal basis. National supervisory authorities may also draw up a list of the kinds of processing operations for which no DPIA is required.

Furthermore, the Article 29 Working Party has clarified in the meantime that DPIAs are only required for processing operations that have been initiated after the GPDR applies effectively on 25 May 2018 or that change significantly after that date. In addition, it is recommended, thus not mandatory, to also carry out DPIAs for processing operations already underway prior to May 2018 if there is a change to the risk represented by the processing operation or if the organizational or societal context of the processing activity has changed.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

14.10.2019 NL law
Kamerdebat over digitalisering van de overheid: aandacht voor bescherming burger vereist

Short Reads - Op 24 september 2019 zijn er vier moties in stemming gebracht én aangenomen door de Tweede Kamer. De moties hebben als gemeenschappelijke deler dat ze in het teken staan van de steeds groter wordende digitalisering bij de overheid. Het achterliggende doel van de moties is dat de burger voldoende beschermd moet worden tegen deze digitalisering.

Read more

02.10.2019 EU law
Seminar: Data protection implications of (a no-deal) Brexit

Seminar - On October 25th at 9.30 am, we organize a seminar where we will discus the implications of a (no-deal) Brexit on data protection.  These issues affect all businesses interacting between UK and EEA (including EU) and which send or receive data to and from UK. We will highlight the main challenges both in the case of a hard Brexit on 31 October 2019 and in other scenarios. We will also offer guidelines to help your organisation mitigate the respective risks.

Read more

27.09.2019 NL law
Stibbe is attending the IBA's annual conference in Seoul

Conference - The annual conference of the International Bar Association (IBA) is currently taking place in Seoul. There are fourteen partners from Stibbe attending the event. Several of them have speaking slots on a wide range of legal topics and will take part in various panel discussions.

Read more

28.08.2019 NL law
Masterclass: e-signature and electronic identifiers

Masterclass - Stibbe is organising a Masterclass on 26 September 2019 in Amsterdam on the subject of e-signature and electronic identifiers. This Masterclass will cover the legal framework and focus especially on the numerous possibilities for applying the various electronic signatures in different situations. In addition, we explain the regulations governing electronic identifiers, and the mandatory European recognition they receive.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring