Chapter 24 — Privacy and data protection: methods I
Lesson map
Lesson 24 published. Map, example, EX070.
flowchart TD
N0["Learning outcomes"]
N1["24.1 When a DPIA is needed"]
N2["24.2 Scoring risks"]
N3["24.3 Measures and residual risk"]
N4["24.4 Prior consultation"]
N5["Lab — DPIA risk scores before and after measures"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX070"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 When a DPIA is needed"]
N2["24.2 Scoring risks"]
N3["24.3 Measures and residual risk"]
N4["24.4 Prior consultation"]
N5["Lab — DPIA risk scores before and after measures"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX070"]
[Learning outcomes]
|
v
[24.1 When a DPIA is needed]
|
v
[24.2 Scoring risks]
|
v
[24.3 Measures and residual risk]
|
v
[24.4 Prior consultation]
|
v
[Lab — DPIA risk scores before and after measures]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX070]
Learning outcomes
You will (1) conduct a data protection impact assessment; (2) score risks before and after measures; (3) decide whether prior consultation is needed.
24.1 When a DPIA is needed
Article 35 of the GDPR requires a data protection impact assessment where processing is likely to result in a high risk to people's rights and freedoms, in particular for large-scale processing of special categories. The Article 29 Working Party guidelines (WP248 rev.01), endorsed by the EDPB, list criteria such as sensitive data, large scale and vulnerable data subjects; meeting two criteria usually indicates a DPIA is needed. Pellmore's telemedicine processing meets several. Zara prepares the DPIA with the data protection officer, whose advice Article 35(2) requires the controller to seek.
24.2 Scoring risks
Zara takes the five threats from Chapter 23 and scores each for likelihood and severity on a one-to-four scale, then multiplies them. Before measures, indefinite video retention scores 9, the analytics SDK sending health events scores 12, misdirected results 8, staff snooping 9 and a vendor breach of chat logs 6. Four risks are high or medium-high. She is careful to explain that the scores are an ordering aid, not measurements, and that the descriptions of harm matter more than the numbers when people decide what to do.
24.3 Measures and residual risk
For each risk Zara lists measures: thirty-day retention with monthly keys, removal of the analytics SDK, two-identifier matching for results, access logging with anomaly review and contractual limits on the vendor. After measures, scores fall to 3, 4, 4 and 4 for the first four risks, but the vendor breach stays at 6, because Pellmore cannot control the vendor's security directly. No risk remains high. The residual medium risk is accepted by Pellmore's management with a plan to review the vendor at contract renewal. Renewal is in eighteen months.
24.4 Prior consultation
Article 36 requires the controller to consult the supervisory authority before processing where a DPIA indicates high risk that the controller has not mitigated. Zara's register shows no residual high risk, so prior consultation is not triggered by this assessment. She writes this conclusion carefully, noting that it depends on the measures actually being implemented. If the analytics SDK were not removed, the risk would remain high. The DPIA therefore lists implementation of measures as conditions with owners and dates, and it is scheduled for review after the first quarter.
Lab — DPIA risk scores before and after measures
# DPIA risk scoring: likelihood x severity (1-4 each), before and after planned measures.
risks = [("video recordings kept indefinitely", 3, 3, 1, 3), ("analytics SDK sends health events", 3, 4, 1, 4),
("wrong patient receives results", 2, 4, 1, 4), ("staff browse records without need", 3, 3, 2, 2),
("vendor breach exposes chat logs", 2, 3, 2, 3)]
def band(s): return "high" if s >= 9 else "medium" if s >= 5 else "low"
for name, l, s, l2, s2 in risks:
print(f"{name:38s} before {l*s:2d} ({band(l*s):6s}) after {l2*s2:2d} ({band(l2*s2)})")
hi = [n for n, l, s, l2, s2 in risks if l2 * s2 >= 9]
print("residual high risks:", hi if hi else "none; prior consultation under Art 36 not triggered by this register")
Run with python3 lab_dpia.py. Verified output:
video recordings kept indefinitely before 9 (high ) after 3 (low)
analytics SDK sends health events before 12 (high ) after 4 (low)
wrong patient receives results before 8 (medium) after 4 (low)
staff browse records without need before 9 (high ) after 4 (low)
vendor breach exposes chat logs before 6 (medium) after 6 (medium)
residual high risks: none; prior consultation under Art 36 not triggered by this register
Worked example
Zara scores five risks, reduces four from high or medium to low with measures, keeps the vendor breach at medium (6) and concludes that prior consultation is not triggered if the measures are implemented.
Synthetic case. Risks and scores are synthetic; GDPR Articles 35 and 36 and WP248 rev.01 are real.
Errors and limits
Multiplying ordinal scores is a convention, not arithmetic on real quantities.
Exercises
- EX070 — DPIA trigger. Why does Pellmore need a DPIA? Rubric: 3 = large-scale special-category processing meets several WP248 criteria, indicating high risk;; 2 = mentions health data;; 1 = not needed;; 0 = none.
- EX071 — Unchanged risk. Which risk stays medium after measures, and why? Rubric: 3 = vendor breach of chat logs, because Pellmore cannot directly control vendor security;; 2 = names risk;; 1 = vague;; 0 = none.
- EX072 — Conditional conclusion. Why is the "no prior consultation" conclusion conditional? Rubric: 3 = it depends on the measures being implemented, e.g. removing the SDK;; 2 = mentions measures;; 1 = unconditional;; 0 = none.
Synthesis
Chapter 24 assesses risk. Chapter 25 is the first design studio.
Continue studying — chapter 24 of 50
← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →