In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?

Question

Options

• AA medical organization that wants to begin genetic testing to support earlier research for which
• BA data controller who plans to use a new technology product that has already undergone a DPIA
• CA marketing team that wants to collect mailing addresses of customers for whom they already
• DA railway operator who plans to evaluate the same video surveillance in all the train stations of his

• A
  7% (3)
• B
  13% (6)
• C
  4% (2)
• D
  76% (34)

Explanation

According to the WP29 guidance on DPIA1, conducting a single DPIA to address multiple processing operations is allowed when the following conditions are met: The processing operations present similar high risks, which would result in very similar mitigating The DPIA is reviewed and updated regularly to take into account any changes or new risks; The DPIA is complemented by ad hoc assessments where necessary to address more specific issues. The WP29 guidance cites the example of a railway operator who plans to evaluate the same video surveillance in all the train stations of his company as a case where a single DPIA would be sufficient, provided that the above conditions are met.

No community discussion yet for this question.