Portuguese Data Protection Authority activities - Data Protection Impact Assessment List and notifications for DPO and Data Breaches
The list of processing activities set forth on Draft Regulation no. 1/2018 is a non-exhaustive and dynamic list to be updated whenever deemed necessary. The DPA determines that the following processing activities are subject to a DPIA:
- Processing of categories of personal data established in paragraph 1 of article 9 (special categories of personal data) and in Article 10 (personal data related to criminal convictions and offences) of GDPR for other purposes than those for which they have been collected, except if such processing is regulated by law and is preceded by a DPIA;
- Processing of information resulting from the use of sensors or other electronic devices that transmit, through communication networks, personal data, with legal effects on data subjects or that significantly affect them in a similar manner, namely those that allow to analyse and predict the localization and movements, personal preferences or interests, consumptions or other behaviours and health of data subjects (e.g.: implanted or applied medical devices);
- Interconnection of personal data or processing of personal data that links the data referred in paragraph 1 of Article 9 of GDPR;
- Processing of personal data based on indirect collection, where it is not possible or feasible to ensure the right to information, under Article 14 of GDPR;
- Processing of personal data consisting of profiling on a large scale;
- Processing of personal data that allows to track the localization or behaviour of the data subjects, except where the processing is essential for the provision of services required by Clients;
- Processing of biometric personal data for unambiguous identification of the data subjects, except if such processing is regulated by law and is preceded by a DPIA;
- Processing of personal data using new technologies or new use of existing technologies;
- Significant change of the information system’s architecture on which the processing of personal data is carried out.
The deadline to submit the contributions to the public consultation will end on September 18th.
In compliance with its obligations under the GDPR, the Portuguese Data Protection Authority also made available at its website (www.cnpd.pt) two different forms as a result of the application of GDPR.
One of those forms is related to the communication to the DPA of the data controllers’ Data Protection Officer (“DPO”), which is available at www.cnpd.pt/DPO/. This form allows the data controller to (i) make the notification of its DPO, (ii) amend a previous notification or (iii) communicate the termination of the duties performed by the DPO.
Finally, the other form relates to the notification of a personal data breach to the DPA, under Article 33 of GDPR and is available at www.cnpd.pt/DataBreach/. This form allows data controller to (i) notify a personal data breach and (ii) amend a previous notification that has been submitted to the DPA.
Article provided by: Ricardo Henriques (Abreu Advogados)
Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project
Director CPC project: Dr. Tobias Höllwarth, tobias.hoellwarth@eurocloud.org