Search

The purpose of this Chapter is to provide sufficiently detailed explanations to enable the completion of the Template for reporting the integrated impact assessment process (Annex 1). The assessors consult this Chapter’s instructions in conjunction with Annex 1, whose structure firmly corresponds to the structure herein. The Template for reporting the integrated impact assessment process in Annex 1 is organised into tables and matrices. Following the 11-step method, consecutive steps are marked in brown and the ongoing steps in orange, as presented in the diagram below. The assessors are to fill in only the fields coloured in light brown or light orange. A field for any further remarks or comments, if necessary, is provided at the end of each step. The assessors fill in, in an easily understandable language, the empty rows in the tables and/or other fields assigned to each step. To the greatest extent possible, each answer is exhaustive and sufficiently motivated (described, explained, justified, etc.), as is equally the case for the criteria/explanations ‘fulfilled’ and ‘not fulfilled’. Further rows can be added in each table, should there be a need, or, should the space be insufficient, each element can be moved to attachments. Alternatively, any of the tables and/or fields may be removed, and the same information presented in some other format if the assessors deem it appropriate. Provision of an explanation is required whether the box is ticked or not. After the receipt of the filled-in report, the sponsoring organisation, in turn, fills in the light green fields only, facilitating the final decision (of whether or not to proceed with the envisaged initiative). The Template assumes the team of assessors is familiar with the legal framework for personal data protection and privacy in the European Union, as well as the principles of ethics and social acceptance. (References to legal provisions without any further specification pertain to the General Data Protection Regulation [GDPR].) It also assumes mini-mum familiarity with the process of risk appraisal and with the criteria limiting the enjoyment of human rights, in particular those of necessity and proportionality. Furthermore, it is expected that all relevant stakeholders, be they the data controller(s), the data protection officer (DPO), the pertinent EU agencies and border control authorities, among others, are involved in the entirety of the assessment process. As the assessment process concerns an as-yet-unimplemented initiative, the assessors may have to rely on estimations and, at times, incomplete information.

This Policy Brief proposes a template for a report from a process of data protection impact assessment (DPIA) in the European Union (EU). Grounded in the previously elaborated framework (cf. Policy Brief No. 1/2017) and method for impact assessment (cf. Policy Brief No. 1/2019), the proposed template conforms to the requirements of Articles 35–36 of the General Data Protection Regulation (GDPR) and reflects best practices for impact assessment, offering at the same time five novel aspects. First, it aims at comprehensiveness to arrive at the most robust advice for decision making. Second, it aims at efficiency, that is, to produce effects with the least use of resources. Third, it aims at exploring and accommodating the perspectives of various stakeholders, although the perspective of individuals dominates; it, therefore, fosters fundamental rights thinking by, for example, requiring justification for each choice, hence going beyond a mere ‘tick-box’ exercise. Fourth, it aims at adhering to the legal design approach to guide the assessors in a practical, easy and intuitive manner throughout the 11-step assessment process, providing necessary explanations for each step, while being structured in expandable and modifiable tables and fields to fill in. Fifth, it assumes its lack of finality as it will need to be revised as experience with its use grows. The template is addressed predominantly to assessors entrusted by data controllers to perform the assessment process, yet it may also assist data protection authorities (DPA) in the EU to develop (tailored down) templates for DPIA for their own jurisdictions.

This Policy Brief proposes a template for a report from a process of data protection impact assessment (DPIA) in the European Union (EU). Grounded in the previously elaborated framework (cf. Policy Brief No. 1/2017) and method for impact assessment (cf. Policy Brief No. 1/2019), the proposed template conforms to the requirements of Articles 35–36 of the General Data Protection Regulation (GDPR) and reflects best practices for impact assessment, offering at the same time five novel aspects. First, it aims at comprehensiveness to arrive at the most robust advice for decision making. Second, it aims at efficiency, that is, to produce effects with the least use of resources. Third, it aims at exploring and accommodating the perspectives of various stakeholders, although the perspective of individuals dominates; it, therefore, fosters fundamental rights thinking by, for example, requiring justification for each choice, hence going beyond a mere ‘tick-box’ exercise. Fourth, it aims at adhering to the legal design approach to guide the assessors in a practical, easy and intuitive manner throughout the 11-step assessment process, providing necessary explanations for each step, while being structured in expandable and modifiable tables and fields to fill in. Fifth, it assumes its lack of finality as it will need to be revised as experience with its use grows. The template is addressed predominantly to assessors entrusted by data controllers to perform the assessment process, yet it may also assist data protection authorities (DPA) in the EU to develop (tailored down) templates for DPIA for their own jurisdictions.

This Policy Brief proposes a template for a report from a process of data protection impact assessment (DPIA) in the European Union (EU). Grounded in the previously elaborated framework (cf. Policy Brief No. 1/2017) and method for impact assessment (cf. Policy Brief No. 1/2019), the proposed template conforms to the requirements of Articles 35–36 of the General Data Protection Regulation (GDPR) and reflects best practices for impact assessment, offering at the same time five novel aspects. First, it aims at comprehensiveness to arrive at the most robust advice for decision making. Second, it aims at efficiency, that is, to produce effects with the least use of resources. Third, it aims at exploring and accommodating the perspectives of various stakeholders, although the perspective of individuals dominates; it, therefore, fosters fundamental rights thinking by, for example, requiring justification for each choice, hence going beyond a mere ‘tick-box’ exercise. Fourth, it aims at adhering to the legal design approach to guide the assessors in a practical, easy and intuitive manner throughout the 11-step assessment process, providing necessary explanations for each step, while being structured in expandable and modifiable tables and fields to fill in. Fifth, it assumes its lack of finality as it will need to be revised as experience with its use grows. The template is addressed predominantly to assessors entrusted by data controllers to perform the assessment process, yet it may also assist data protection authorities (DPA) in the EU to develop (tailored down) templates for DPIA for their own jurisdictions.