Necessity of a data protection impact assessment

Before a data protection impact assessment (DPIA) is carried out, the question arises whether it is required at all. It is mandatory only where the processing is likely to result in a high risk to the rights and freedoms of natural persons (Article 35(1) GDPR). This preliminary examination is known as the threshold analysis. It must be conducted at an early stage and documented, including where it concludes that no data protection impact assessment is necessary.

1. The threshold analysis

1.1 Standard: likely to result in a high risk

What matters is a forecast. Taking into account the nature, scope, context and purposes of the processing, the processing must be likely to result in a high risk (Article 35(1), first sentence, GDPR). These four attributes must be considered cumulatively; often the high risk emerges only from their interaction, but in individual cases it may follow from a single attribute alone, for instance from the purpose pursued.

What must always be assessed is the risk to the data subjects, not the economic or legal risk to the company. Potential fines or damage to the controller's reputation or business are irrelevant at this point. What matters is the possible physical, material or non-material damage to the data subjects, such as discrimination, identity theft, financial loss or loss of control over their own personal data (Recital 75 GDPR).

1.2 The four attributes in detail

The threshold analysis examines the planned processing against four attributes. Each of them may increase the risk:

• Nature of the processing. What does it involve in substance? Profiling, automated decisions, the processing of special categories of data or systematic monitoring all increase the risk. Example: the automated analysis of browsing and purchasing behavior for advertising purposes.
• Scope of the processing. How many persons, how much data, over what period and across what territory (see 1.3)? Example: a nationwide customer database with millions of records weighs more heavily than a local customer list.
• Context of the processing. Does it take place openly or covertly, can the data subject avoid it, are many bodies involved? Example: background processing that the data subjects cannot recognize weighs more heavily than processing to which they actively agree.
• Purposes of the processing. What does it serve? The more intrusive the purpose (evaluating, monitoring or steering persons), the more likely it is that a high risk must be assumed.

1.3 What large scale means

Whether processing is carried out on a large scale is not determined by absolute figures alone. The Article 29 Working Party identifies four factors that must be assessed together (WP 248 Rev. 01):

• the number of data subjects concerned, either as a specific number or as a proportion of the relevant population,
• the volume of data and the range of data types processed,
• the duration and permanence of the processing,
• the geographical extent.

On this basis, an individual physician processing the data of his or her patients does not act on a large scale, whereas a hospital processing the data of a large number of patients does.

1.4 New technologies

The Regulation singles out the use of new technologies (Article 35(1), first sentence, GDPR). A high risk is to be assumed in particular where extensive processing operations involving large amounts of data affect a large number of persons or include particularly sensitive data (Recital 91 GDPR). Typical fields of application include connected vehicles, connected health applications, big data and tracking techniques, artificial intelligence methods, the combination of biometric techniques such as fingerprint and facial recognition, and new surveillance technology.

Irrespective of the technology used, a high risk exists above all where the processing makes it more difficult for data subjects to exercise their rights or prevents them from doing so, for instance in the case of high complexity and lack of transparency, a large number of controllers involved, or covert and suspicionless processing as part of monitoring and security measures (Recital 91 GDPR).

1.5 An efficient order of examination

Whether a data protection impact assessment must be carried out can be answered only by reading several paragraphs together. Instead of following the numerical order, it is more efficient to examine them in reverse:

2. Statutory examples (paragraph 3)

Article 35(3) GDPR names three cases in which a data protection impact assessment is in particular required. The list is not exhaustive.

2.1 Systematic and extensive evaluation (point (a))

This covers a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects or similarly significantly affect the person concerned. Examples:

• credit scoring by banks or credit reference agencies to determine the risk of default,
• risk assessment by insurers to set the level of premiums,
• fully automated pre-selection of applicants in e-recruiting without any intermediate human review.

2.2 Large-scale processing of special categories of data (point (b))

This covers processing on a large scale of special categories of data under Article 9(1) GDPR or of personal data relating to criminal convictions and offenses under Article 10 GDPR. Here the high risk already follows from the nature of the data itself (see Article 9). Examples:

• the processing of patient data by a hospital,
• the large-scale processing of data on trade union membership or religious beliefs,
• the operation of a register containing data on criminal convictions.

The decisive factor is the large scale: the processing of sensitive data by an individual professional does not, as a rule, satisfy this statutory example (see 1.4).

2.3 Systematic monitoring of publicly accessible areas (point (c))

This covers systematic monitoring of publicly accessible areas on a large scale, typically by video surveillance. Examples:

• video surveillance of a large shopping center or of a station forecourt,
• comprehensive monitoring of publicly accessible business premises with public footfall.

2.4 Positive list of the supervisory authority (paragraph 4)

The supervisory authorities establish and make public a list of the processing operations for which a data protection impact assessment must be carried out (Article 35(4) GDPR). For the non-public sector, the German supervisory authorities have agreed on a joint mandatory list, which the European Data Protection Board has confirmed (German Data Protection Conference (DSK), list of processing activities under Article 35(4) GDPR). For the federal public sector, the German Federal Commissioner for Data Protection and Freedom of Information (BfDI) maintains its own list; an overview of both lists is provided by the collection of mandatory lists at the BfDI. For the public sector of the German federal states, individual supervisory authorities maintain further lists of their own.

3. The nine criteria for assessing the risk

Where the examination of the lists and the statutory examples yields no result, the high risk under Article 35(1) GDPR must be forecast on a case-by-case basis. The nine criteria of the Article 29 Working Party, each of which indicates an increased risk, provide guidance (Article 29 Working Party, Guidelines on Data Protection Impact Assessment, WP 248 Rev. 01):

Rule of thumb: where two of these criteria are met, a data protection impact assessment must generally be carried out. The more criteria that apply, the more likely the obligation is. In case of doubt, the Article 29 Working Party recommends carrying out a data protection impact assessment, because it helps the controller to comply with the requirements of the GDPR (WP 248 Rev. 01).

Thus it is sufficient, for example, to combine evaluation (No. 1) and large scale (No. 5) in a customer loyalty program involving profiling, systematic monitoring (No. 3) and vulnerable employees (No. 7) in the analysis of working behavior, or special categories of data (No. 4) and innovative technology (No. 8) in a health app.

4. Examples from the mandatory list of the supervisory authorities

The following overview summarizes the 17 processing activities of the German mandatory list for the non-public sector. Where the planned processing is equivalent to one of these activities, a data protection impact assessment must always be carried out (DSK mandatory list).

5. Case examples

5.1 Credit scoring in an online shop

Facts: Before displaying the payment option of purchase on account, an online shop checks the customer's risk of default by combining its own data with information from third-party sources into a risk score.

Assessment: Several criteria apply: evaluation and scoring (No. 1), combining datasets (No. 6) and a decision with a significant effect on the customer (No. 2). The processing also corresponds to No. 5 of the mandatory list.

Conclusion: A data protection impact assessment must be carried out.

5.2 Movement profiles of field staff

Facts: A company uses GPS to locate the company vehicles of its field staff in order to coordinate assignments, and stores the location data permanently.

Assessment: The data subjects are vulnerable employees (No. 7), there is systematic monitoring (No. 3), and the data can be used to evaluate working behavior. The processing corresponds to No. 8 of the mandatory list.

Conclusion: A data protection impact assessment must be carried out.

5.3 Counterexample: a simple customer file

Facts: A small trade business keeps a customer file containing names, addresses and invoicing data for the purpose of handling orders, without profiling, without sensitive data and without automated decisions.

Assessment: At most a single, weakly pronounced attribute applies. Neither a statutory example nor two of the criteria are met; the processing does not appear on the mandatory list.

Conclusion: A data protection impact assessment is not required. The result of the threshold analysis must nevertheless be documented (see 8.).

6. A single impact assessment for several processing operations

A single data protection impact assessment may address a set of similar processing operations that present similar high risks (Article 35(1), second sentence, GDPR). This makes clear that one form of processing may comprise several individual operations, and it is sensible for reasons of economy (Recital 92 GDPR). This may be an option, for instance, where several bodies use a common application or platform or where a measure of the same kind is introduced at several sites. The obligation to carry out a data protection impact assessment nevertheless remains with each controller.

7. Exemptions from the obligation to carry out an assessment

7.1 Negative list of the supervisory authority (paragraph 5)

The supervisory authorities may in addition establish a list of the processing operations for which no data protection impact assessment is required (Article 35(5) GDPR). Unlike the positive list, the negative list is optional. The German supervisory authorities have not published one to date.

7.2 Impact assessment already carried out by the legislature (paragraph 10)

Where the processing has a legal basis under Article 6(1)(c) or (e) GDPR and an impact assessment was already carried out as part of the adoption of that legal basis, the controller's obligation does not apply unless the legislature expressly requires a further data protection impact assessment (Article 35(10) GDPR). Its practical significance is limited, because legislatures have so far hardly ever carried out an impact assessment of their own. Only legal bases adopted after the GDPR became applicable come into consideration.

8. Involvement of the data protection officer and documentation

Once it is established that a data protection impact assessment must be carried out, the controller seeks the advice of the data protection officer, where one has been designated (Article 35(2) GDPR). This involvement is procedurally mandatory, but the advice is not binding. The fact that mere involvement is required also means that the data protection impact assessment cannot be delegated to the data protection officer but remains a matter for the controller. How the roles are allocated within the company is dealt with on the subpage Internal company organization.