In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?
A.
A medical organization that wants to begin genetic testing to support earlier research for which they have performed a DPIA.
B.
A data controller who plans to use a new technology product that has already undergone a DPIA by the product’s provider.
C.
A marketing team that wants to collect mailing addresses of customers for whom they already have email addresses.
D.
A railway operator who plans to evaluate the same video surveillance in all the train stations of his company.
According to the WP29 guidance on DPIA1, conducting a single DPIA to address multiple processing operations is allowed when the following conditions are met:
The processing operations present similar high risks, which would result in very similar mitigating measures;
The DPIA is reviewed and updated regularly to take into account any changes or new risks;
The DPIA is complemented by ad hoc assessments where necessary to address more specific issues.
The WP29 guidance cites the example of a railway operator who plans to evaluate the same video surveillance in all the train stations of his company as a case where a single DPIA would be sufficient, provided that the above conditions are met2. The other options do not meet these conditions, as they involve different types of processing operations, different purposes, different data subjects, or different technologies. References:
WP29 guidance on DPIA
WP29 guidance on DPIA, page 16
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit