From:
Sent:
14 November 2018 12:31
To:
European Data Protection Board
Subject:
Request for information on national draft decisions and lists of processing
operations which requires a DPIA
Dear Sir and Madam,
with reference to your press release from the 26th of September and your 22 opinions regarding the lists of
data protection impact assessments of different member states, we approach you with the fol owing request.
Since it is unfortunately not possible to obtain lists of processing operations which are subject to the
requirement for a data protection impact assessment within the meaining of Art. 35 (4) GDPR at the individual
national supervisory authorities, we kindly ask you to submit us these lists or rather the draft decisions of such
lists available to you in the context of the consistency mechanism.
Since, in the meantime, the two-week deadline under Article 64 (7) GDPR has expired, we would be grateful if
you could provide us with information on which member states have maintain its draft decision and which have
amend its draft decision. In this case we would ask you if you could send us the amended draft decisions.
In order to properly advise our clients as to what types of processing operations requires a data protection
impact assessment, it is necessary for us to know the content of such lists.
As your press release further suggests, you have establish common criteria on what triggers a DPIA and what
not. Although the GDPR does not require an "EU list", it does appear necessary that you have created a
comparable list or overview in the context of the consistency mechanism. We would also be very grateful to
you if such a document could be made available to us.
We thank you in advance for your efforts.
Sincerely yours,
T
· F
· M
Registered office:
Equity partners:
Salary partner:
VAT No.:
1
2