GDPR – Privacy Impact Assessment

GDPR does not use the term “privacy impact assessment”. Article 35 requires a data protection impact assessment (DPIA): an assessment, carried out before processing starts, of any processing likely to result in a high risk to people’s rights and freedoms. In both cases documented below, the organisation had a risk assessment. The regulator found it did not meet Article 35.

Which Articles Govern DPIAs

When a DPIA Is Mandatory

Article 35(3) requires a DPIA in three cases:

• Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based
• Large-scale processing of special category data (Art. 9(1)) or criminal conviction and offence data (Art. 10)
• Systematic monitoring of a publicly accessible area on a large scale

This list is not exhaustive. Under Article 35(4), each supervisory authority has published its own list of processing that requires a DPIA; the EDPB issued opinions on the draft lists before they were adopted. Check the list of the authority competent for your processing.

The Nine High-Risk Criteria

The Article 29 Working Party’s DPIA guidelines (WP248 rev.01), endorsed by the EDPB, list nine criteria indicating high risk:

• Evaluation or scoring, including profiling and predicting
• Automated decision-making with legal or similar significant effect
• Systematic monitoring
• Sensitive data or data of a highly personal nature
• Data processed on a large scale
• Matching or combining datasets
• Data concerning vulnerable data subjects, such as children or employees
• Innovative use or application of new technological or organisational solutions
• Processing that prevents data subjects from exercising a right or using a service or contract

The guidelines state that in most cases, processing meeting two criteria requires a DPIA, and in some cases one criterion is enough.

What a DPIA Must Contain

Article 35(7) sets the minimum content:

• A systematic description of the processing and its purposes, including any legitimate interest pursued
• An assessment of the necessity and proportionality of the processing in relation to the purposes
• An assessment of the risks to the rights and freedoms of data subjects
• The measures envisaged to address those risks, including safeguards, security measures and mechanisms to demonstrate compliance

In the Skellefteå case, the school board’s risk assessment was rejected because it did not assess risks to the students’ rights and freedoms and did not document proportionality.

Prior Consultation Under Article 36

If the DPIA shows a high risk that remains without mitigating measures, the controller must consult the supervisory authority before processing. If the authority considers the processing would infringe GDPR, it must give written advice within up to eight weeks, extendable by six weeks for complex processing, and may use its Article 58 powers. Launching high-risk processing without an adequate DPIA or consultation can breach both Articles 35 and 36, as the Skellefteå decision found.

DPIAs and the EU AI Act

Under the EU AI Act, deployers of high-risk AI systems must, where applicable, use the provider’s Article 13 information to carry out their GDPR DPIA (Art. 26(9)). Certain deployers must also carry out a fundamental rights impact assessment (Art. 27). Where the DPIA already meets an Article 27 obligation, the FRIA complements the DPIA (Art. 27(4)).

Real Cases

In the Skellefteå and Instagram decisions, the Article 35 finding sat alongside breaches of other articles. The Snap investigation concerned Articles 35 and 36 only.

See all privacy impact assessment cases →

Recitals That Explain This Issue

Checklist

• Screen new processing against Article 35(3), your authority’s list and the nine criteria before processing starts, including pilots
• Assess risks to the people whose data is processed, not only to the organisation
• Document necessity and proportionality, including why less intrusive options were rejected
• Seek and record your DPO’s advice (Art. 35(2))
• Seek the views of data subjects or their representatives where appropriate (Art. 35(9))
• Consult the supervisory authority before processing if high risk remains (Art. 36)
• Review the DPIA when the risk changes (Art. 35(11))
• For high-risk AI systems, use the provider’s information in the DPIA and align it with any FRIA