Risk analysis and impact assessments: GDPR
Probably the introduction of the obligation to carry out risk analysis or impact assessments on privacy is one of the main novelties introduced by the new personal data protection regulations .
An impact assessment on the protection of personal data
(DPIA) is an analysis of the risks that a product or service may entail for the
protection of data of those affected and, as a consequence of this analysis,
the management of said risks by adopting of the necessary measures to eliminate
or mitigate them.
A DPIA is a tool that goes beyond an evaluation of
regulatory compliance - although, obviously, the verification of such
compliance is an integral part of any DPIA - and that goes so far into the
expectations of privacy that people have before any treatment of your personal
data as in the general perceptions of society or, specifically, of the groups
most affected by the treatment in question.
Specifically, the RGPD establishes that in those cases in
which it is probable that the processing operations entail a high risk for the
rights and freedoms of natural persons, it must be the responsibility of the
controller to carry out an impact assessment related to the protection of data,
which evaluates, in particular, the origin, nature, particularity and severity
of said risk.
The result of the evaluation must be taken into account when
deciding the appropriate measures to be taken in order to demonstrate that the
processing of personal data is in accordance with this Regulation.
In accordance with the RGPD, the person in charge must carry
out , before the treatment, an impact assessment related to data protection in
order to assess the particular severity and probability of the high risk,
taking into account the nature, scope, context and purposes of the treatment
and the origins of the risk.
Said impact assessment must include, in particular, the
measures, guarantees and mechanisms provided to mitigate risk, guarantee the
protection of personal data and demonstrate compliance with this Regulation.
If an impact assessment related to data protection shows
that the processing operations involve a high risk that the controller cannot
mitigate with adequate measures in terms of available technology and
application costs, the supervisory authority should be consulted before
processing. .
Obligation to carry out the impact assessment
In accordance with the provisions of article 35 of the RGPD
, the file manager must carry out the impact assessment of the personal data
processing processes whenever any of the following situations occurs, without
prejudice to the fact that said list may be expanded by part of the national
control authorities (the Spanish Agency for Data Protection).
These situations are:
1. When it
is probable that a type of treatment, in particular if it uses new
technologies, by its nature, scope, context or purposes, involves a high risk
for the rights and freedoms of natural persons.
2. When the
systematic and exhaustive evaluation of personal aspects of natural persons is
carried out that is based on an automated treatment, such as the elaboration of
profiles, and on the basis of which decisions are made that produce legal
effects for the natural persons or that significantly affect them similarly.
3. When
large-scale data processing of special categories of data or personal data
relating to convictions and criminal offenses is carried out.
4. When
conducting large-scale systematic observation of a public access area.
Procedure for conducting impact evaluations
To carry out the impact evaluations, the AEPD published a
complete guide that should be taken as a reference document.
Specifically, the impact assessment, in accordance with the
RGPD, must have the following contents:
1. A
systematic description of the planned treatment operations and the purposes of
the treatment, including, where appropriate, the legitimate interest pursued by
the person responsible for the treatment.
2. An
assessment of the necessity and proportionality of the processing operations
with respect to their purpose.
3. An
assessment of the risks to the rights and freedoms of the interested parties referred
to in the first section.
4. The
measures envisaged to face the risks, including guarantees, security measures
and mechanisms that guarantee the protection of personal data, and to
demonstrate compliance with this Regulation, taking into account the rights and
legitimate interests of the interested parties and other affected persons.
