DPIA: Data Protection Impact Assessment

DPIA: Data Protection Impact Assessment, private data protection impact assessment

Here are the main features of the DPIA, Data Protection Impact Assessment, treatment impact assessment by the owner.

In order to ensure conspicuous protection of personal data, substantial measures have been taken by the relevant bodies, including the Gdpr,the EU general regulation on the protection of privacy. This legislation will become operational on May 25, 2018, on all nations belonging to the European Community. All companies that center their activities in EU territories must adapt their websites to this European directive.

Among the cornerstones of this measure is the DPIA, Data Protection Impact Assessment, private data protection impact assessment It is a system for assessing the risks that may arise from potential breaches in the processing of personal data, as well as any annexed aftermath.

This issue was previously addressed by the GDPR Privacy Guarantors Group (WP29), which set out the highlights regarding impact assessment in the event of a data protection breach. It also recommends employing it for all processing of personal data, not just high-risk processing.

DPIA: Data Protection Impact Assestment

There DPIA consists of a Initial assessment of the impacts and hazards that may affect a possible infraction of the processing of personal information. Allows the owner to demonstrate fulfillment of the means necessary to comply with GDPR regulations.

This analysis is characterized by two considerations:

• level of risk, Of the rights of affected users;
• evolutionary state and Technology of the means used to process the data.

In order to identify appropriate measures to decrease risks, the document only determines the criteria to be followed. It is expressed a discordance between the measures to limit risks and those Directed at manifesting compliance with the GDPR. 
What is most noticeable from the guidelines, however, is the conception that risk assessment is not a single and unique activity over time, but a constant process and flow.

Manager of conducting DPIA impact assessment

The sole guarantor of the impact assessment is the data controller. This burden cannot be entrusted to any other figure.  Management can be performed independently, Within the corporate apparatus, or delegating the task to a third party.  However, the owner, who must maintain continuous control, remains the one and only one who has the complete responsibility. Consequently, it becomes necessary to maintain direct interaction with the DPO, Data Protection Officer, the employee in charge of the protection and storage of personal information.

Therefore, the Data Controller is obliged to. Identify the causes, complexity, and factors that characterize risk, But also the purpose and mode of use of the same, before the data are extrapolated. Not surprisingly. in the presence of high data hazard, heavy will be the repercussions in terms of impact.

The legislation lists two different points regarding this issue: 

• Article 24, which places the examination of risks among the cornerstones, in order to put in place the necessary measures to safeguard treatment. The holder in fact has the burden of certifying that it has taken the necessary steps to align treatment to the GDPR regulation;
• Article 35, in case of major dangers to the privacy of affected users, it becomes necessary to implement a peculiar impact assessment;
• Article 36, stipulates the obligation of precautionary consultation by the of the supervisory authority in case the owner considers the adaptation of specific measures.

The owner must comply with certain guidelines:

• explain the reasons for the evaluations, and the choices made, in the written document that makes up the conventional part of the DPIA;
• Define the figure who performed the analysis of treatments, and determined the necessary arrangements;
• Specify whether you have commissioned an outside professional;
• Task performed by the treatment manager;
• Viewpoints Of the DPO, upon appointment.

When DPIA is required by regulation

DPIA is necessary when there are high risks to users' rights. Next we forward Article35(3) of the GDPR, which fully explains the issue:

“impact assessment is mandatory in the presence of:

• A systematic and comprehensive assessment of personal aspects relating to individuals based on automated processing;
• large-scale processing of special categories of personal data or data relating to criminal convictions and offenses;
• A large-scale systematic surveillance of a publicly accessible area."

It can be easily observed that the canons related to a necessary impact assessment are:

• extension and circumstance Of treatment,
• Number of stakeholders
• Characteristics of private information

The DPIA must be performed prior to the start of the treatment. If there is no danger it can be stopped. The physical components of the instruments used should also be considered at this juncture.

When DPIA is not mandatory

According to the provisions of the Guarantor Group, DPIA should not be implemented in some cases:

• Low danger of users' rights and privacy;
• Check already performed by the Supervisory Authority before the GDPR was issued (May 25, 2018)
• References to directives of a community state
• In the case of optional treatments

If you need counseling, you can contact Attorney Gabriele Carmelo Gallo I work with to ask your question.