Under the General Data Protection Regulation (GDPR), which situation would be LEAST likely to require a Data Protection Impact Assessment (DPIA)?

A Data Protection Impact Assessment (DPIA) is required under GDPR Article 35 for processing operations that are "likely to result in a high risk to the rights and freedoms of natural persons." Sending a generic daily digest via a mailing list is a standard, low-risk marketing activity. It does not typically involve the criteria that trigger a DPIA, such as processing special categories of data, systematic monitoring, or automated decision-making with significant legal effects. The other scenarios all contain clear indicators of high-risk processing.

A. Processing patients' genetic and health data involves special categories of data on a large scale, which is a primary trigger for a DPIA under GDPR Article 35(3)(b).

B. Using a camera system to monitor highways constitutes large-scale, systematic monitoring of a publicly accessible area, an explicit example requiring a DPIA in GDPR Article 35(3)(c).

C. Systematically monitoring employees' internet activity involves vulnerable data subjects (due to the employer-employee power imbalance) and systematic monitoring, making a DPIA highly likely.

1. General Data Protection Regulation (EU) 2016/679

Article 35

"Data protection impact assessment."

Article 35(1) establishes the requirement for a DPIA where processing is "likely to result in a high risk."

Article 35(3)(b) specifies that a DPIA is required for "processing on a large scale of special categories of data referred to in Article 9(1)." (Relevant to option A).

Article 35(3)(c) requires a DPIA for "a systematic monitoring of a publicly accessible area on a large scale." (Relevant to option B).

2. European Data Protection Board (EDPB)

"Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk' for the purposes of Regulation 2016/679

" WP248 rev.01

adopted on 4 April 2017

as last revised and adopted on 4 October 2017.

Section III.B

Criteria for a "likely high risk

" lists criteria to assess risk. Option A involves "Sensitive data." Option B involves "Systematic monitoring." Option C involves "Systematic monitoring" and "Data concerning vulnerable data subjects." Option D does not inherently meet these criteria.

3. University of Cambridge

Information Compliance Office

"Data Protection Impact Assessments (DPIAs)."

The guidance states

"A DPIA is required for any type of processing which is likely to result in a high risk to the rights and freedoms of individuals

" and directly references the criteria from the EDPB/ICO

including "systematic monitoring

" processing "special category data

" and processing data of "vulnerable individuals

" confirming the high-risk nature of options A

B

and C.