Twitter Logo Youtube Circle Icon LinkedIn Icon

The Legal 500 Hall of Fame Icon The Legal 500 Hall of Fame highlights individuals who have received constant praise by their clients for continued excellence. The Hall of Fame highlights, to clients, the law firm partners who are at the pinnacle of the profession. In Europe, Middle East and Africa, the criteria for entry is to have been recognised by The Legal 500 as one of the elite leading lawyers for seven consecutive years. These partners are highlighted below and throughout the editorial.
Click here for more details

Austria > Legal Developments > Law firm and leading lawyer rankings



December 2018 - Intellectual Property. Legal Developments by Dorda.

More articles by this firm.

Processing operations subject to the requirement of a data protection impact assessment.

Following the "White List", the data protection authority has now also issued the long-awaited "Black List" in form of a binding regulation. This provides greater clarity as to when Data Protection Impact Assessments ("DPIA") are actually to be carried out in practice in Austria. As already in the draft, the regulation does not provide an exhaustive list of processing operations that are subject to the requirement. Rather, the regulation specifies criteria - some of which require further interpretation - which shall make it necessary to carry out a detailed examination.

Art 35 GDPR establishes the requirement for controllers to carry out and continuously update DPIA if the data processing is associated with a "probably high risk" for the data subjects. In practice, however, it is sometimes difficult to assess when such a high risk is to be expected. Art 35 Para 5 GDPR therefore stipulates that the Data Protection Authorities shall provide a list of processing operations ("Black List") which are subject to the requirement of a DPIA in any case. This shall make the vague criteria more tangible for the controllers and processors and at the same time to serve as an aid to interpretation.

After a first draft of the Austrian Data Protection Authority had circulated a few weeks ago, the corresponding regulation of the authority on processing operations for which a data protection impact assessment is to be carried out ("DSFA-V") was published on 9 November 2018. As previously explained by DORDA data protection experts, this is a supplement to the existing Austrian White List, which as opposite exempts certain processing operations from the obligation to carry out a data protection impact assessment since 25 May 2018.

In a nutshell, the recently issued Black List distinguishes between processing operations where a DPIA must already be carried out in the case of one criterion and those where at least two different criteria must apply cumulatively in order to trigger this obligation. However, data processing operations that are already included in the White List are expressly excluded from the requirement of a DPIA. This establishes a meaningful link between the two lists. In practice, both regulations have to be reviewed in parallel when assessing the necessity of a DPIA.

The issued Black List largely corresponds to Data Protection Authority's previously published draft. One welcomed aspect is that the critical comments on the draft by European Data Protection Board - which is also chaired by Dr Jelinek - have been taken into account: For instance, the mere existence of joint controllers as a trigger for an obligation to carry out a DPIA has finally been deleted.

As a result, each of the following criteria for itself triggers the requirement for a DPIA:

  • Ratings or classifications (including profiling and forecasting) in case of potential adverse effects;
  • Profiling and automated decision making;
  • Monitoring, surveillance or control of data subjects, in particular in public areas;
  • Data processing using or applying new or advanced technologies or organisational solutions, in particular artificial intelligence or biometric data processing;
  • Merging and/or comparing data sets resulting from more than one processing operation, where such merging and/or comparing may lead to adverse decisions;
  • Data processing in the personal area - even with consent

With regard to employment relationships, there is a (reasonable) exception for processing operations already authorized by a plant agreement (consent of the works council) or the consent of the staff representatives. This is most likely based on the appreciated consideration that in such cases the involvement of a concrete body who represents data subject's interests and thus ensures control of the measures and sufficient reconciliation of interests. Thus, no further examination is required.

A data protection impact assessment shall also be carried out if at least two of the following criteria are met:

        Â· Large-scale processing of special categories of personal data;

        Â· Large-scale processing of data on criminal convictions and offences;

     Â· Collection of location data as defined in the Telecommunications Act (Telekommunikationsgesetz – TKG);

·  Processing of data on persons in need of higher protection (e.g. minors, employees, patients, mentally ill persons and asylum seekers);

· Merging and/or comparing of data sets from several processing operations, provided that they are processed for purposes other than originally intended.

However, it is still unclear what "large-scale" processing means. Recital 91 only provides the well-known negative definition that data processing should not be considered to be on a large scale if the processing concerns patients or clients of an individual physician or lawyer. At the same time, however, it is not possible to deduce when the threshold of large-scale processing is reached.

Both regulations - Black and White List – now provide for greater clarity as to when and under what circumstances a DPIA is required. Nevertheless, in practice, there is still room for interpretation due to the purposes and criteria, some of which are only roughly explained. It will therefore be up to the practical exercise and, above all, the decisions of the national Data Protection Authorities and, in particular, the European Court of Justice, to provide for sharper distinctions in this regard.

Authors: Axel AnderlFelix HörlsbergerNino TlapakDominik SchellingAlexandra Ciarnau

Interview with...

Law firm partners and practice heads explain how their firms are adapting to clients' changing needs

International Law Firm Networks

International comparative guides

Giving the in-house community greater insight to the law and regulations in different jurisdictions.

Select Practice Area

GC Powerlist -

International Law Firm Networks