Activities Requiring Data Protection Impact Assessment Under Luxembourg Law

The Luxembourg National Data Protection Commission (Commission nationale pour la protection des données, CNPD) has published a list of processing operations which require a mandatory data protection impact assessment in accordance with article 35 of the General Data Protection Regulation (GDPR).

What is a data protection impact assessment (DPIA)?

A DPIA represents a meaningful analysis of the impact of data processing on the data subjects concerned (processing which is required to be respectful of the privacy of such data subjects, in consonance with the fundamental principles of the GDPR).

What does a list of processing operations contain?

The list put forward by the CNPD does not consist of a comprehensive list of processing operations outside of which a DPIA would not be necessary - it is limited to those operations for which a data controller will necessarily need to perform a DPIA. The requirement for a DPIA in relation to operations not featured on the list will have to be assessed in accordance with the criteria of article 35, GDPR and the Guidelines on Data Protection Impact Assessment (WP248), issued by the Article 29 Working Party.

Certain operations in respect of which a DPIA is mandatory:

(subject to a limited exemption for health professionals providing certain services) involving the processing of genetic data (article 4 (13), GDPR); involving the processing of biometric data (article 4 (14), GDPR) for the purpose of identifying data subjects; involving the combination, matching or comparison of personal data collected from processing operations with different purposes (from the same or different controllers) - that produce legal effects / have a significant impact on the data subject; that consist of or include regular and systematic control of the activities of employees - that produce legal effects / have a significant impact on employees; certain operations for historical research /...