Scenario: A clinical research organization collects and processes sensitive personal data of individuals for medical research purposes. The data is encrypted and stored in a central database using a one-way hashing function (bcrypt). The organization conducted a risk assessment to identify and mitigate risks. Questio n: Should a DPIA be conducted in this case?

A Data Protection Impact Assessment (DPIA) is mandatory under GDPR Article 35 when processing is "likely to result in a high risk to the rights and freedoms of natural persons." The scenario involves two key criteria that indicate high risk: the processing of special categories of personal data (sensitive health data) and data concerning vulnerable data subjects (participants in clinical research). The European Data Protection Board (EDPB) guidelines specify that when two or more such criteria are met, a DPIA is required. The purpose of the DPIA is to systematically analyze the processing and implement measures to mitigate the identified high risks.

B. Encryption is a security measure to mitigate risk, but its presence does not eliminate the legal obligation to conduct a DPIA when the processing is inherently high-risk.
C. A general risk assessment may identify the need for a DPIA, but it is not a substitute for the specific, legally mandated DPIA process required by GDPR for high-risk processing.
D. The requirement for a DPIA is based on the nature and risk of the processing, not on a specific data retention period. There is no such five-year rule in the GDPR.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 35(1) and Article 35(3)(b). Article 35(1) establishes the requirement for a DPIA for high-risk processing. Article 35(3)(b) explicitly lists "processing on a large scale of special categories of data referred to in Article 9(1)" as a case requiring a DPIA.

2. European Data Protection Board (formerly Article 29 Working Party), "Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk' for the purposes of Regulation 2016/679," WP248 rev.01, adopted on 4 October 2017. Section III.A and Annex 2 list the criteria for high-risk processing, which include "sensitive data" (Criterion 3) and "data concerning vulnerable data subjects" (Criterion 4). The guidelines state, "As a rule of thumb, a processing operation meeting two criteria would require a DPIA to be carried out."

3. KU Leuven Centre for IT & IP Law (CiTiP), "The data protection impact assessment: A tool for accountability?", Working Paper, 2018. This academic paper discusses the role of DPIAs, noting their mandatory nature for processing operations involving sensitive data and vulnerable persons, such as in health research, to ensure accountability and risk management. (See Section 3, "When is a DPIA required?").