Regulation on Processing Operations for which a Data
Protection Impact Assessment must
be carried out
On November 9th 2018, the Austrian Data Protection Authority
issued a list stipulating data processing operations that in all
cases require a data protection impact assessment
("DPIA"). Under the EU General Data Protection Regulation
(GDPR) the controller must carry out a DPIA if certain criteria
under Art 35 are met. The so-called "blacklist" issued by
national data protection authorities will further specify the
relevant scenarios triggering a DPIA obligation without prejudice
to the provisions of the GDPR.
However, the Austrian blacklist mainly summarizes the criteria
already mentioned in Art 35 and unfortunately still leaves several
grey areas as to the interpretation of individual controllers.
Failure to carry out a DPIA is subject to fines of up to EUR 10m or
2% of the total worldwide annual turnover.
