The Italian Data Protection Authority Has Drafted The List Of Processing Operations Subject To A DPIA – Practical Implications And Accountability Considerations

Background:

On October 11, 2018, the Italian Data Protection Authority (hereafter referred to as "Garante") issued, pursuant to Article 35(4) GDPR, the list containing further processing activities [i.e. processing activities additional to those provided for in art. 35(3)] that require a Data Protection Impact Assessment ("DPIA") to be carried out prior to the processing. The list was adopted after having positively implemented the opinion and instructions of the European Data Protection Board ("EDPB") published on September 25, 2018 (see ICT Insider of October).

In short, each national Supervisory Authority ("SA") was required to draw up a draft list containing the types of processing activities that would require a Data Protection Impact Assessment to be carried out prior to their initiation and implementation. The draft list had then to be sent to the EDPB with a view to scrutinise the use of the margin of discretion left to the SAs, in order to ensure a