COMPLIANCE WITH THE DATA PROTECTION ACT
The Data Protection Act 2019 brought with it a number of compliance strategies for companies, among them conducting of Data Protection Impact Assessments. Section 31 of the Act mandates a data controller or a data processor to conduct a Data Protection Impact Assessment [DPIA] prior to a processing operation that would result in high risk to the rights and freedoms of a data subject.
The first port of call therefore is to answer the question; what is a Data Protection Impact Assessment? A DPIA is a procedure of identifying risks in processing personal data and minimizing these risks as early as possible. This procedure does not take away these risks permanently, it only manages them and helps an organization put in place better mechanisms in preparation for the data processing.
The Act mandates that a DPIA must be conducted when processing of data would result in high risk to the data subject’s rights. What type of processing pose ‘high risk’ to the rights of a data subject? They include:
a) Processing of sensitive personal data;
b) Processing of data in large volumes;
c) Processing that is mainly centered on automated decision making e.g profiling;
d) Data processed to monitor data subjects – like public surveillance;
e) Where data is being processed through new technological/ organizational solutions;
f) When processing data of vulnerable data subjects;
g) When matching or combining data sets; and
h) When processing of data prevents a data subject from exercising a right.
Nonetheless, it is imperative that data controllers or processors conduct DPIAs to ensure that their data processing mechanisms do not infringe on or pose risks on any rights of data subjects. Further, where a data controller/processor is of the opinion that processing data in the named instances will not pose any risk to data subjects, they are mandated to notify the ODPC and seek guidance on the same.
What must a data controller/processor capture in a DPIA?
The basic requirements of a DPIA are set out in section 31(1) of the Act. Additionally, the data protection mechanisms given in the Act set further requirements of a DPIA. Therefore, a DPIA has to include:
1. The amount of personal data that is to be collected;
2. The extent of processing of the said data;
3. The period and method of storage of this data and its accessibility;
4. The type of technology used for processing the data;
5. The specific risks existing in processing of this data;
6. A description of the envisaged processing operations and purposes of the processing;
- An assessment of the necessity and proportionality of the processing operations in relation to the purposes; and
- The measures envisaged to address the risks and the safeguards, security measures and mechanisms to ensure the protection of personal data and compliance with the Act.
It is important to note that the ODPC requires that data controllers or processors submit DPIAs 60days before the commencement of processing of data. Where the data processing had already commenced (before the commencement of the Act) the ODPC requires that the DPIA be submitted as soon as possible, in order to prevent any penalties for non-compliance.
