RISKY BUSINESS: Technologies Requiring a Data Protection Impact Assessment (DPIA) under the GDPR
Under the European Union GDPR privacy compliance obligations, Data Protection Impact Assessments (DPIA) are mandatory for data processing “likely to result in a high risk to the rights and freedoms of data subjects.” Failure to conduct such a risk assessment is a breach of the GDPR that is subject to significant fines. Whether an organization is required to comply with the GDPR is beyond the scope of this article but if your organization processes any of the following types of “risky” Personal Data of EU or UK citizens listed in the table below, now is the time to find out. Personal Data is broadly defined as any information relating to an identified or identifiable natural person, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. How can an organization determine whether to incur the expense of conducting a DPIA? According to Article 35(3) of the GDPR, there are three types of processing that always require a DPIA: 1) systematic profiling with significant effects; 2) large scale use of …