To facilitate compliance with the General Data Protection Regulation, the Spanish Data Protection Agency, or AEPD, has published data protection impact assessment guidelines and risk assessment guidelines (in Spanish).
The guidelines provide information and examples about the concepts, measures and techniques that could be applied to identify, evaluate and manage the risks and high risks involved in the processing of personal data. The guidelines also help organizations know how to reduce such risks to an acceptable or tolerable level, meet individuals' expectations of privacy, and comply with the GDPR.
Under the risk assessment guidelines, organizations are first required to determine the level of risk of their data processing activities in multiple scenarios and over time, taking into account, among other things, the following criteria:
- The technologies (cloud, databases, servers), applications, devices and/or techniques used for processing personal data, as well as the nature, scope, context and purposes of the processing.
- The classification of their database through typologies (e.g., human resources, marketing, children, data concerning health and/or filing system), purposes of the processing, or level of sensitivity, value and criticality of the data.
- The data lifecycle, similar processing operations that present similar risks and risks by defect.
- The individuals who can access or use personal data, such as data processors, third parties, recipients or employees.
- Potential harms associated with the processing activity and potential negative impacts on data subject rights that could result from a data breach if it materializes.
- The list of the kind of processing operations that are subject to the requirement for a data protection impact assessment, as adopted by the Article 29 Data Protection Working Party, the GDPR (Article 35(3)), and the guide.
This global risk-based approach will ensure that the risks presented by the processing of personal data can be appropriately identified and classified as high risk, risk or low risk regarding the rights and freedoms of data subjects. This approach also permits determining whether a data protection impact assessment is required, in particular where the processing operation is considered likely to result in a high risk to individuals (Article 35(1) of the GDPR).
The authority emphasizes that the organizations must not only justify and document their reasons for not carrying out a DPIA, but also maintain a record containing information regarding the assessment, including, inter alia, the name and contact details of the data controller, the controller's representative and the data protection officer, the purposes of the processing, a description of the categories of data subjects and of the categories of personal data and a general description of the technical and organizational security measures.
The mere fact that the conditions triggering the obligation to carry out a DPIA have not been met does not, however, diminish data controllers' general obligation to implement measures to appropriately manage risks for the rights and freedoms of data subjects. This is the approach of the WP29 in its guide on DPIAs as well.
Under the DPIA guidelines, organizations can identify and manage high risks that a system, product or service can generate regarding the rights and freedoms of natural persons. They can also mitigate such high risks with safeguards, technical and organizational measures and controls before they materialize, some of which are referenced in the guide, including encryption.
In addition, the result of the DPIA must be taken into account by the organizations to carry out (or not) the data processing, but it also helps them to decide whether to consult with, and/or obtain prior authorization from, the supervisory authority in relation to the data processing under Article 36 of the GDPR.
The DPIA methodology includes (but is not limited to):
- An assessment of the necessity and proportionality of the processing operations in relation to the purposes.
- A systematic description of the envisaged processing operations, including the data lifecycle and its flow.
- The nature, scope, context and purposes of the processing for which the personal data are intended, as well as the legal basis for such processing.
- The technologies (cloud computing, databases, servers), applications, devices and/or techniques used for processing personal data.
- An assessment of the high risks to the rights and freedoms of data subjects resulting from the processing of personal data, the probability of possible threats as well as possible harms that could result from a personal data breach; e.g., physical, material and/or moral harms.
- Organizational, legal and technical measures envisaged to address and minimize the risks to an acceptable or tolerable level and to demonstrate compliance with the GDPR.
The guidelines also state that the obligation to implement, develop and monitor the DPIA can be fulfilled by internal or external personnel of the organizations, taking into account the 'Responsibility Assignment Matrix' methodology, for example.
Additionally, the personnel must seek the views of the data protection officer and internal partners (for instance, human recourses, marketing, legal, risk management, information security and/or information technology), as well as the data processors and data subjects, where appropriate.
In order to ensure a consistent application of the guidelines and demonstrate compliance with the GDPR, organizations must maintain the traceable records of all decisions made during the course of their DPIA.
In May, once the GDPR is applicable, following the guidelines will be required where a new personal data processing, system or technology is being introduced.
photo credit: Contando Estrelas España, España, España via photopin(license)