A controller plans black-box profiling of vulnerable individuals yet completes only a one-page form ticking ‘low risk’ with no analysis of impacts or mitigations. How should that DPIA practice be judged?
Select an answer to reveal the explanation.
Short Explanation
Calling skydiving ‘low risk’ on a sticky note is not a safety review. High-risk black-box profiling of vulnerable people needs a real look at harms and safeguards. A one-page tick does not earn Article 35 credit.
Full Explanation
A data protection impact assessment must describe the processing, assess necessity and proportionality, evaluate risks to rights and freedoms, and document measures to address those risks. Black-box profiling of vulnerable individuals is a high-risk pattern; a one-page form that merely ticks “low risk” without analysis is inadequate and undermines Article 35 accountability. Vulnerable populations—patients, children, economically precarious users—deserve serious impact analysis before opaque profiling ships into production.
A tickbox signed by marketing does not satisfy Article 35. Use of machine learning does not exempt controllers from DPIAs; complexity and opacity often increase the need for assessment. Controllers—not only processors—must assess profiling risk for purposes they determine.
Exam caveat: if residual risk remains high after mitigations, consult the supervisory authority under Article 36 before proceeding. Article 22 automated-decision safeguards may also apply alongside the DPIA where legal or similarly significant effects arise.
Operational check: rewrite the DPIA with concrete threat scenarios for vulnerable groups, list mitigations such as human review, minimisation, transparency, and objection paths, involve the DPO, and block launch until the assessment is substantive rather than performative.