IEEE Technology and Society Magazine - December 2020 - 65

approach embodied by the GDPR, carrying out a DPIA is
not mandatory for every processing operation " [20]
Notably, in the point 84 of recital to GDPR it was indicated that in order to enhance compliance with this Regulation where processing operations are likely to result
in a high risk to the rights and freedoms of natural persons, the controller should be responsible for the carrying-out of a data protection impact assessment to
evaluate, in particular, the origin, nature, particularity
and severity of that risk. The outcome of the assessment
should be taken into account when determining the
appropriate measures to be taken in order to demonstrate that the processing of personal data complies with
this Regulation. Where a data-protection impact assessment indicates that processing operations involve a high
risk which the controller cannot mitigate by appropriate
measures in terms of available technology and costs of
implementation, a consultation of the supervisory
authority should take place prior to the processing.
Regulation included in the Article 35 (1) of the GDPR
indicates that where a type of processing in particular
using new technologies, and taking into account the
nature, scope, context, and purposes of the processing, is
likely to result in a high risk to the rights and freedoms of
natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal
data. A single assessment may address a set of similar
processing operations that present similar high risks.
Moreover, a data protection impact assessment
referred to in paragraph 1 shall in particular be required
in the case of:
a) a systematic and extensive evaluation of personal
aspects relating to natural persons which is based on
automated processing, including profiling, and on
which decisions are based that produce legal effects
concerning the natural person or similarly significantly affect the natural person;
b) processing on a large scale of special categories of
data referred to in Article 9(1),2 or of personal data
relating to criminal convictions and offences referred
to in Article 10; or
c) a systematic monitoring of a publicly accessible area
on a large scale.
It is worth remembering that the phrase used by the
regulator in the words " in particular " in the introductory

2

According to the regulation from art. 9 (1) GDPR: Processing of personal
data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic
data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life
or sexual orientation shall be prohibited.

DECEMBER 2020

∕

sentence of Article 35(3) GDPR indicates that this is
meant as a non-exhaustive list. Therefore, the catalog is
not closed and final.
Article 29 Data Protection Working Party shows that
in the operations of processing that are " likely to result
in a high risk, " the list of specific criteria should be
taken into account.
Two of those criteria are particularly relevant to this
work. First is the so-called systematic monitoring. Systemic monitoring refers to the processes of observation,
monitoring, or controlling data subjects; this encompasses the information gathered through networks, as
well as the data coming from public areas being monitored. This kind of monitoring is relevant here, as personal information might be gathered without data
subjects being aware of either the sole fact of being
monitored or the prospective use of the data. In addition to this, it might simply not be possible to avoid public/publicly available spaces in order not to become
subject to this type of processing [20]).
The other criterion concerns the personal information that is processed on a large scale. The GPDR
lacks clear definition of large scale, however. Nevertheless, WP 29 suggests taking into consideration the
four factors in order to decide if the processing is a
large-scale one:
a) The number of the data subjects the processing concerns; it may be the exact number or the proportion
of the population in question,
b) The range of various items of data and/or its volume,
c) The information concerning the processing; its duration or permanence,
d) The extent of the processing activities in terms of
area [20].
All in all, in the title of the GDPR the word " General "
was used, applying to a unified approach across the
whole of Europe. However, the " G " could stand for
" Global " as well, as the regulation concerns all the organizations everywhere in the world that happen to process or control personal data of the EU people. It is also
worth mentioning that the financial penalties the noncompliant organizations will face are based on total
worldwide revenue, not only the money earned within
the member states of the EU [21].

Data Subject Consent
This section of the GDPR covers data subject consent
and legal and practical guidelines for processing personal data without data subject consent (in order to protect
computer systems and networks).
An organization is not allowed to do anything with
personal data unless the data subject has given the

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

65
IEEE Technology and Society Magazine - December 2020

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - December 2020
