An organization's AI policy states that all AI systems processing sensitive personal data must conduct a Data Protection Impact Assessment (DPIA). An AI system analyzes employee emails to detect insider threats. Which DPIA finding would MOST likely require escalation to the supervisory authority under GDPR?
Select an answer to reveal the explanation.
Short Explanation
You need to escalate when the DPIA shows high residual risks that still can't be reduced to an acceptable level after all feasible mitigations. That's the GDPR trigger for consulting the supervisory authority before moving ahead.
Full Explanation
The correct finding is that the DPIA concludes residual risks remain high after all feasible mitigations have been applied, and the risks cannot be reduced to an acceptable level. Under GDPR Article 36, if a DPIA indicates high risks that the controller cannot sufficiently mitigate, the controller must consult the supervisory authority before proceeding. High residual risk after mitigation is precisely the trigger for prior consultation with the data protection authority. The finding about processing emails of more than 500 employees is relevant to DPIA triggering thresholds, but it does not by itself require escalation. The finding about being unable to achieve precision above 80% on insider threat detection is a performance concern, not the specific GDPR escalation trigger. The finding about retaining email content for 90 days rather than the minimum required for threat investigation may be a compliance issue, but it does not alone trigger authority escalation.