Data Protection Impact Assessments (DPIA) at DPPC2018
Data Protection Impact Assessments
Drop-in advice session
Charter 4
Tell us what you think
Go to slido.com/#DPPC2018/DPIA
Data Protection Impact Assessments
What are they & when are they required?
Guide to the GDPR
DPIA Awareness checklist
DPIA Screening checklist
DPIA Process checklist
DPIA consultation- closes Friday
Tell us your thoughts @ ico.org.uk
A process for building and demonstrating compliance
Can be used for;
•
a single processing operation,
•
a group of similar operations and
•
evaluating the impact of a technology product.
Assess the impact of envisaged processing
•
Describe processing
•
Necessity/proportionality
•
Assess level of risk
•
Identify measures to address risk
Article 35
Where a type of processing in particular using new technologies, and
taking into account the nature, scope, context and purposes of the
processing, is likely to result in a high risk to the rights and freedoms
of natural persons, the controller shall, prior to the processing, carry
out an assessment of the impact of the envisaged processing
operations on the protection of personal data.
Article 35
Where a type of processing in
particular using new technologies
,
and
taking into account the nature, scope, context and purposes
of the
processing, is likely to result in a high risk to the rights and freedoms
of natural persons, the controller shall, prior to the processing, carry
out an assessment of the impact of the envisaged processing
operations on the protection of personal data.
Article 35
Where a type of processing in
particular using new technologies
,
and
taking into account the nature, scope, context and purposes
of the
processing, is
likely to result in a high risk to the rights and freedoms
of natural persons
, the controller shall, prior to the processing, carry
out an assessment of the impact of the envisaged processing
operations on the protection of personal data.
Clause 64(1) – DP Bill
Part 3 – Law enforcement purposes
Where a type of processing
is likely to result in a high risk to the rights and
freedoms of individuals
, the controller must, prior to the processing, carry out
a data protection impact assessment.
Recital 77
“The risk to the rights and freedoms of natural persons, of varying likelihood and severity,
may result from data processing which could lead to physical, material or non-material
damage, in particular: where the processing may give rise to discrimination, identity theft
or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data
protected by professional secrecy, unauthorised reversal of pseudonymisation, or any
other significant economic or social disadvantage; where data subjects might be deprived
of their rights and freedoms or prevented from exercising control over their personal
data…”.
Article 35(4)
•
New Technologies
•
Profiling/SPD access to services
•
Profile individuals (large scale)
•
Biometric data
•
Genetic data
•
Match/combine datasets
•
Invisible processing
•
Track location/behaviour
•
Profile children/vulnerable
•
Data which may endanger
subjects in case of a breach
Article 35(3)
Systematic, extensive
evaluation (ADM/profiling
Large scale Art 9/10 processing
Large scale monitoring,
publically accessible area
1.
New technologies
2.
Denial of service
3.
Large-scale profiling
4.
Biometric data
5.
Genetic data
ICO proposed list
6.
Risk of physical harm
7.
Data matching
8.
Invisible processing
9.
Tracking
10.
Targeting of children/vulnerable
individuals
1,
New Technologies
Processing involving the use of new technologies,
or the novel application of existing technologies (including AI).
2,
Denial of service
Decisions about an individual’s access to a product,
service, opportunity or benefit which is based to any extent on
automated decision-making (including profiling) or involves the
processing of special category data.
3,
Large-scale profiling
Any profiling of individuals on a large scale.
What does large scale mean?
You should consider:
Number of individuals
Volume of data
Variety of data
Duration of the processing
Geographical extent
Tracking individuals using a city’s public transport system
A hospital processing patient data (not an individual clinician)
Want to ask us a question?
Go to slido.com/#DPPC2018/DPIA
4,
Biometrics
Any processing of biometric data.
5,
Genetic data
Any processing of genetic data other than that processed
by an individual GP or health professional, for the provision of health
care direct to the data subject.
6,
Data matching
Combining, comparing or matching personal data
obtained from multiple sources.
7,
Invisible processing
Processing of personal data that has not been
obtained direct from the data subject in circumstances where the
controller considers that compliance with Article 14 would prove
impossible or involve disproportionate effort.
8,
Tracking
Processing which involves tracking an individual’s geolocation
or behaviour, including but not limited to the online environment.
9,
Targeting of children or other
vulnerable individuals
The use of the personal data of children or other vulnerable individuals for
marketing purposes, profiling or other automated decision-making, or if
you intend to offer online services directly to children.
10,
Risk of physical harm
Where the processing is of such a nature that a
personal data breach could jeopardise the [physical] health or safety of
individuals.
DPIA consultation- closes Friday
Tell us your thoughts @ ico.org.uk
Guide to the GDPR
DPIA Awareness checklist
DPIA Screening checklist
DPIA Process checklist
Exploring topics related to Data Protection Impact Assessments (DPIA) at the Data Protection Practitioners Conference 2018 (#DPPC2018). Learn about the importance of DPIAs, guidelines for GDPR compliance, consultation processes, and steps for conducting a DPIA. Discover how to identify risks, assess necessity, and implement measures to mitigate risk in data processing operations. Stay informed about DPIA requirements and compliance procedures in the context of data protection regulations.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Data Protection Impact Assessments Drop-in advice session Charter 4 Data Protection Practitioners Conference 2018 #DPPC2018
Tell us what you think Go to slido.com/#DPPC2018/DPIA Data Protection Practitioners Conference 2018 #DPPC2018
Data Protection Impact Assessments What are they & when are they required? Data Protection Practitioners Conference 2018 #DPPC2018
Guide to the GDPR DPIA Awareness checklist DPIA Screening checklist DPIA Process checklist Data Protection Practitioners Conference 2018 #DPPC2018
DPIA consultation- closes Friday Tell us your thoughts @ ico.org.uk Data Protection Practitioners Conference 2018 #DPPC2018
A process for building and demonstrating compliance Can be used for; a single processing operation, a group of similar operations and evaluating the impact of a technology product. Data Protection Practitioners Conference 2018 #DPPC2018
Assess the impact of envisaged processing Describe processing Necessity/proportionality Assess level of risk Identify measures to address risk Data Protection Practitioners Conference 2018 #DPPC2018
1: Identify need for a DPIA 9: Keep under review 2: Describe the processing 8: Integrate outcomes into plan 3: Consider consultation 7: Sign off and record outcomes 4: Assess necessity and proportionality 6: Identify measures to mitigate risk 5: Identify and assess risks Data Protection Practitioners Conference 2018 #DPPC2018
Article 35 Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. Data Protection Practitioners Conference 2018 #DPPC2018
Article 35 Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. Data Protection Practitioners Conference 2018 #DPPC2018
Article 35 Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. Data Protection Practitioners Conference 2018 #DPPC2018
Clause 64(1) DP Bill Part 3 Law enforcement purposes Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a data protection impact assessment. Data Protection Practitioners Conference 2018 #DPPC2018
Recital 77 The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data . Data Protection Practitioners Conference 2018 #DPPC2018
Article 35(4) Article 35(3) Systematic, extensive evaluation (ADM/profiling New Technologies Profiling/SPD access to services Profile individuals (large scale) Biometric data Genetic data Match/combine datasets Invisible processing Track location/behaviour Profile children/vulnerable Data which may endanger subjects in case of a breach Large scale Art 9/10 processing Large scale monitoring, publically accessible area
ICO proposed list 1. New technologies 6. Risk of physical harm 2. Denial of service 7. Data matching 3. Large-scale profiling 8. Invisible processing 4. Biometric data 9. Tracking 5. Genetic data 10.Targeting of children/vulnerable individuals Data Protection Practitioners Conference 2018 #DPPC2018
1, New Technologies Processing involving the use of new technologies, or the novel application of existing technologies (including AI). Data Protection Practitioners Conference 2018 #DPPC2018
2, Denial of service Decisions about an individual s access to a product, service, opportunity or benefit which is based to any extent on automated decision-making (including profiling) or involves the processing of special category data. Data Protection Practitioners Conference 2018 #DPPC2018
3, Large-scale profiling Any profiling of individuals on a large scale. Data Protection Practitioners Conference 2018 #DPPC2018
What does large scale mean? You should consider: Number of individuals Volume of data Variety of data Duration of the processing Geographical extent Data Protection Practitioners Conference 2018 #DPPC2018
Tracking individuals using a citys public transport system Data Protection Practitioners Conference 2018 #DPPC2018
A hospital processing patient data (not an individual clinician) Data Protection Practitioners Conference 2018 #DPPC2018
Want to ask us a question? Go to slido.com/#DPPC2018/DPIA Data Protection Practitioners Conference 2018 #DPPC2018
4, Biometrics Any processing of biometric data. Data Protection Practitioners Conference 2018 #DPPC2018
5, Genetic data Any processing of genetic data other than that processed by an individual GP or health professional, for the provision of health care direct to the data subject. Data Protection Practitioners Conference 2018 #DPPC2018
6, Data matching Combining, comparing or matching personal data obtained from multiple sources. Data Protection Practitioners Conference 2018 #DPPC2018
7, Invisible processing Processing of personal data that has not been obtained direct from the data subject in circumstances where the controller considers that compliance with Article 14 would prove impossible or involve disproportionate effort. Data Protection Practitioners Conference 2018 #DPPC2018
8, Tracking Processing which involves tracking an individual s geolocation or behaviour, including but not limited to the online environment. Data Protection Practitioners Conference 2018 #DPPC2018
9, Targeting of children or other vulnerable individuals The use of the personal data of children or other vulnerable individuals for marketing purposes, profiling or other automated decision-making, or if you intend to offer online services directly to children. Data Protection Practitioners Conference 2018 #DPPC2018
10, Risk of physical harm Where the processing is of such a nature that a personal data breach could jeopardise the [physical] health or safety of individuals. Data Protection Practitioners Conference 2018 #DPPC2018
Data Protection Practitioners Conference 2018 #DPPC2018
DPIA consultation- closes Friday Tell us your thoughts @ ico.org.uk Data Protection Practitioners Conference 2018 #DPPC2018
Guide to the GDPR DPIA Awareness checklist DPIA Screening checklist DPIA Process checklist Data Protection Practitioners Conference 2018 #DPPC2018
