Background <\/u><\/p>\n
Opinion 12\/2018<\/strong> adopted on 25 September 2018 by the European Data Protection Board<\/em> or \u201cEDPB\u201d, has recently been made public. The EDPB is the body that is mainly in charge of ensuring a uniform and consistent application of EU Regulation 679\/2016 on the protection of natural persons with regard to the processing of personal data (\u201dGDPR<\/strong>\u201d) in all member States. The EDPB succeeded the previous \u201cWorking Party 29<\/em>\u201d or \u201cWP29\u201d and has broader powers and new duties.<\/p>\n As part of its work of aligning the various internal practices, in the last few months the Supervisory Authorities of the member States submitted to the EDPB their list of \u201ctypes of data processing<\/em>\u201d which require a prior \u201cdata protection impact assessment\u201d<\/em><\/strong> (DPIA) as a condition for legality of the processing.<\/p>\n The Italian case<\/u><\/p>\n The list submitted by the Italian Data Protection Authority defines six types of processing that require that a DPIA be conducted beforehand. Specifically, these are:(i) processing of biometric data; (ii) processing of genetic data; (iii) processing carried out using innovative technologies; (iv) monitoring of employees; (v) \u201cfurther processing of personal data<\/em>\u201d and (vi) processing that refers to a \u201cspecific legal basis<\/em>\u201d.<\/p>\n The EDPB answered the Italian Data Protection Authority with its own observations, some of which were of a general nature while others were of a detailed \u201cprescriptive<\/em>\u201d nature.<\/p>\n Specifically regarding the processing of biometric and genetic data or processing carried out using new technologies, the EDPB considers that this type of processing is not in and of itself able to create a clear risk to the rights and freedoms of the data subjects. In its opinion, for a DPIA to be required, the presence of at least one more<\/u> of the nine cases listed in the \u201cGuidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is \u201clikely to result in a high risk\u201d for the purposes of Regulation 2016\/679<\/em>\u201d adopted by Working Party 29 and commonly referred to as the WP248 guidelines (e.g.: processing that enables judgement of an individual based on profiling; systematic monitoring; matching of various data sets) is necessary.<\/p>\n On the other hand, the EDPB agrees with the Italian Data Protection Authority when the latter claims that systematic monitoring<\/strong> of individuals that are in and of themselves vulnerable, such as employees<\/strong>, constitutes processing that requires<\/strong> a DPIA<\/strong>.<\/p>\n Prospects<\/u><\/p>\n In conclusion, it will be interesting to see how the Italian Data Protection Authority will proceed: if it decides not to follow the \u201cprescriptions\u201d provided by the EDPB, Italy could be the first to be involved in a new dispute resolution mechanism by the Board, with the so-called \u201cconsistency mechanism\u201d pursuant to Articles 63, 64 and 65 of the GDPR.<\/p>\n","protected":false},"excerpt":{"rendered":" Background Opinion 12\/2018 adopted on 25 September 2018 by the European Data Protection Board or \u201cEDPB\u201d, has recently been made public. The EDPB is the body that is mainly in charge of ensuring a uniform and consistent application of EU Regulation 679\/2016 on the protection of natural persons with regard to the processing of personal […]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[177,190,203],"tags":[2423,1320,943],"class_list":["post-24175","post","type-post","status-publish","format-standard","hentry","category-insights","category-practice","tag-dpia","tag-garante-privacy-en","tag-gdpr-en"],"acf":[],"yoast_head":"\n