In January of this year, a credit card company was fined €150,000 by the Dutch Data Protection Authority (hereinafter: ‘the AP’). The reason? They used customers’ personal data on a large scale without first carrying out a legally required Data Protection Impact Assessment (hereinafter ‘DPIA’).

It is the responsibility of the organization acting as data controller to carry out a DPIA when the processing of personal data poses a high privacy risk. A DPIA gives the organization the opportunity to take timely measures to reduce identified privacy risks.

What is a DPIA?
A DPIA stands for a Data Protection Impact Assessment. A DPIA is a tool for mapping out the privacy risks of processing personal data. Although it is the data controller that may be required to carry out a DPIA, involving a processor may be necessary. This is the case if an important (part of a) process is outsourced to a supplier who will process personal data in carrying out that assignment.

Minimum requirements of a DPIA
Under Article 35(7) of the General Data Protection Regulation (hereinafter ‘the GDPR’), a DPIA must contain at least:

• a systematic description of the envisaged processing operations and the purposes of the processing, including the legitimate interests pursued by the controller;
• an assessment of the necessity and proportionality of the processing operations in relation to the purposes;
• an assessment of the risks to the rights and freedoms of data subjects; and
• the measures envisaged to address the risks, such as security measures and mechanisms to ensure the protection of personal data.

When is a DPIA mandatory?
Even smaller organizations can be required under the GDPR to carry out a DPIA. Whether an organization is actually required to carry out a DPIA can be determined using 4 steps.

1. The text of Article 35(1) of the GDPR. This article requires a DPIA to be carried out before any processing takes place that is likely to result in a high risk to the rights and freedoms of natural persons. This is primarily about the privacy risks to data subjects. Think, for example, of systematically and extensively evaluating personal aspects of people, based on automated processing of personal data, such as credit scoring. A DPIA looks at the effects on natural persons, not on the organization itself. In addition, a DPIA is mandatory when an organization processes special categories of personal data on a large scale, or processes criminal record data. Furthermore, carrying out a DPIA is required when the organization systematically monitors people on a large scale in a publicly accessible area, such as through camera surveillance. If one of the three elements from this article applies, a DPIA is mandatory.
2. The (non-exhaustive) list from the AP: this lists types of processing for which organizations are required to carry out a DPIA. Think, for example, of biometric data, fraud prevention, blacklists, location data, etc. The rule of thumb is that if two of the situations on the list apply, a DPIA is mandatory.
3. The 9 criteria of the WP29: the Article 29 Working Party (on the protection of individuals with regard to the processing of personal data) has since been replaced by the EDPB*. But the WP29 also drew up a list for when a DPIA is mandatory, such as: automated decisions, sensitive data, use of new technologies, etc.
4. An independent assessment by a privacy lawyer or privacy expert: However, there are even more situations in which the DPIA obligation applies. Also consider that, even if a DPIA may not be mandatory within your organization, there may still be reasons to carry one out.

Determining whether a DPIA is mandatory is not a simple task. It is therefore wise to bring in an expert to help with this. A qualified professional can help identify the need for a DPIA and carry it out correctly, in order to minimize potential risks.

Is a DPIA a one-off action?
In short, carrying out a DPIA is certainly not a one-off action. It is a continuous process, in which it is essential that you keep track of whether your data processing and the associated risks change. In cases where you want to implement new technology or use personal data for other purposes, it may be necessary to carry out or revise a DPIA. The European Data Protection Board* (the ‘EDPB’) has stated that a DPIA should be reviewed at least once every 3 years.

But… first have a “pre-DPIA” carried out on all your processing activities!
A pre-DPIA is a necessary step prior to the actual DPIA, to determine whether a DPIA is required, and if so, what the scope of that DPIA should be.

The pre-DPIA is a process in which an organization goes through the criteria for the statutory DPIA obligation. This comes down to an inventory and an initial analysis of the data processing activities. A number of aspects taken into account in a pre-DPIA are: the nature, scope, context, and purposes of the processing, the possible risks to the rights and freedoms of data subjects, and a description of which category or categories of data subjects have their personal data processed. The aspects mentioned are not exhaustive.

A GDPR-mature organization has carried out a pre-DPIA on all its processing activities, which is recorded in the processing register.

Consequences of not carrying out a mandatory DPIA
A pre-DPIA may lead to the conclusion that the organization is, after all, required to carry out (or have carried out) a DPIA. If an organization wrongly fails to carry out a DPIA when this is in fact mandatory, and no pre-DPIA has been carried out either, various consequences may follow. This can lead to, among other things:

1. Enforcement measures: The AP can also request the pre-DPIA from an organization. If it is missing, the AP can impose a fine.
2. Fines: The AP can impose fines on the data controller for complying with GDPR requirements. As mentioned earlier, these fines can be substantial. According to the AP’s fining policy, the base fine for not carrying out a mandatory DPIA is €310,000. So, a hefty fine.
3. Reputational damage: An organization that is subject to a measure or fine from the AP will appear in the media. This in turn causes reputational damage.
4. Legal liability: failing to carry out a mandatory DPIA can weaken the legal position of the controller. After all, data subjects whose privacy rights have been violated can file legal claims or proceedings.

General DPIA tips

• If in doubt, contact a specialized privacy lawyer in good time. They can assist you in carrying out a pre-DPIA and/or a DPIA.
• Start the DPIA at the design stage of a new product, service, platform, software, or other project involving data processing (as early as possible). This makes it easier to comply with the legally required principles of “privacy by design”* and “privacy by default”*.
• Update the DPIA in the interim if there are changed or new data processing activities, privacy risks, or context of the processing. Continuously keeping a DPIA up to date is an ongoing process.
• Make sure you periodically check whether adjustments need to be made to the DPIA. Once a year, for example.

Need help?
Should you need advice or help with the pre-DPIA qualification, or with determining whether you are required to carry out a DPIA, or if you need help with this, do not hesitate to contact us at 020-345 0152 or info@thelegalcompany.nl

* “The EDPB is an independent European body. It is the umbrella organization in which the national supervisory authorities of the countries in the European Economic Area (EEA) and the European Data Protection Supervisor (EDPS) work together.” See: https://www.edpb.europa.eu/about-edpb/who-we-are/european-data-protection-board.

*Privacy by design is a concept meaning that privacy measures are built into the design process of a new program/project from the very start. This can mean, for example, maintaining good security systems, or automatically pseudonymizing personal data.

*Privacy by default is a concept that pursues the principle of “data minimization”. Measures must be taken to ensure that as little personal data as possible is collected, that this data is not processed further than necessary, and that this personal data is not retained for longer than necessary. It is also important that personal data is not made accessible to an unlimited number of people.

Nothing changes as constantly as laws and regulations. Please note that our blogs may no longer align with current laws and regulations and may therefore be outdated. If you have questions or an issue relating to this blog, or would like legal assistance, please contact us.