Private Law Theory

ABSTRACT
Article 35 of the GDPR introduces data protection impact assessment (DPIA) as a new obligation for data controllers before the highly risky processing activities. This new obligation is expected to contribute to robust data protection under the GDPR. During the COVID-19 crisis, many countries has created tracing applications to combat the spread of the virus in the European Union. The implementation of these applications requires the preparation of the DPIA. In this article, based on diverse theoretical research, it is suggested that data protection impact assessment in the time of crisis would not positively contribute to the current data protection framework as much as expected since the preparation of the DPIA is envisaged as an internal mechanism. The highly qualified requirement for consultation with data subjects and the lack of broader mandatory stakeholder consultation prejudice the effectiveness of these assessments under the GDPR as these consultation mechanisms would play an external evaluative role in the preparation of these assessments. The disclosure of the DPIA is regarded as a good practice only. This article argues that the disclosure of the assessment would have brought a variety of benefits, including ex-ante transparency, effective use of individual data subject rights and potential improvement of the competition with respect to the data protection policies. In the absence of disclosure, data protection impact would not attain its objective, strengthening the data protection framework. While discussing the weaknesses and potential benefits of necessary stakeholder consultation and disclosure, the examples related to the tracing applications will be given to justify these arguments.

Kun, Eyup, Questioning The Effectiveness of The Data Protectıon Impact Assessment under the GDPR In Time of COVID-19 Crisis (June 30, 2020). Koronavirüs Döneminde Güncel Hukuki Meseleler – Sempozyumu Bildiri (Tam Metin Kitabı) 2020; pp 743-765 Publisher: İbn Haldun Üniversitesi Yayınları.

First posted 2022-02-01 16:00:16