Short Reads

Countdown 8 weeks until GDPR : Will organizations be required to undertake Privacy Impact Assessments when conducting personal data processing?

Stibbe - Will organizations be required to undertake DPIA?

Countdown 8 weeks until GDPR : Will organizations be required to undertake Privacy Impact Assessments when conducting personal data processing?

29.03.2018 EU law

Only 8 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will organizations be required to undertake Privacy Impact Assessments when conducting any kind of personal data processing?

Privacy Impact Assessments or Data Protection Impact Assessments (“DPIA”) are only required in the exceptional situation in which the processing is likely to result in a high risk to the rights and freedoms of natural persons. Whether the processing entails such a high risk will depend on the presence of one or more of the following factors: automated decision-making, evaluation or scoring, systematic monitoring, sensitive data, scale of processing, vulnerable data subjects, data transfers outside the EU, etc. In particular, a DPIA will be required if the processing entails: (i) any systematic and extensive evaluation of personal aspects of natural persons based on automated processing or profiling upon which decisions are based; (ii) processing of so-called “sensitive” categories of personal data on a large scale; or (iii) a systematic monitoring of a publicly accessible area on a large scale. National supervisory authorities are moreover required to establish a list of the types of processing operations that require a DPIA, which is what Belgium has already done, for example.

Conversely, a DPIA is not required if the processing is not likely to result in a high risk. Moreover, other scenarios in which a DPIA is not required are (i) if a DPIA has already been carried out for very similar processing activities or (ii) if the processing has a legal basis under EU law or Member State law and a DPIA has already been carried out as part of a general impact assessment in the context of the adoption of that legal basis. National supervisory authorities may also draw up a list of the kinds of processing operations for which no DPIA is required.

Furthermore, the Article 29 Working Party has clarified in the meantime that DPIAs are only required for processing operations that have been initiated after the GPDR applies effectively on 25 May 2018 or that change significantly after that date. In addition, it is recommended, thus not mandatory, to also carry out DPIAs for processing operations already underway prior to May 2018 if there is a change to the risk represented by the processing operation or if the organizational or societal context of the processing activity has changed.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

27.03.2019 NL law
Ook WhatsApp- en sms-berichten op privételefoons vallen onder Wet openbaarheid van bestuur

Short Reads - De Afdeling bestuursrechtspraak van de Raad van State heeft in een uitspraak van 20 maart 2019 (ECLI:NL:RVS:2019:899) bevestigd dat ook WhatsApp- en sms-berichten onder de reikwijdte van de Wet openbaarheid van bestuur (Wob) vallen. Dat geldt niet alleen voor WhatsApp- en sms-berichten die staan op werktelefoons, maar ook voor berichten die staan op privételefoons van bestuurders of ambtenaren. Daarmee gaat de Afdeling terecht verder dan de rechtbank (ECLI:NL:RBMNE:2017:5979) in eerste aanleg, die van oordeel was dat de Wob niet van toepassing is op berichten op privételefoons.

Read more

21.03.2019 NL law
15 aspects of Brexit you did not know

Short Reads - A Brexit without a deal, or with a deal that does not cover all relevant aspects, is still a potential scenario. We have highlighted a number of unexpected legal consequences of Brexit in such a no deal or incomplete deal scenario.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring