Home

Internal

Global

Contatto

Rödl & Partner ha prestato la propria consulenza per il perfezionamento dell'acquisizione del Gruppo italiano FGV da parte di Hettich |

In tutto il mondo

Utilizziamo cookie tecnici per personalizzare il sito web e offrire all’utente un servizio di maggior valore. Chiudendo il banner e continuando con la navigazione verranno installati nel Suo dispositivo i cookie tecnici necessari ai fini della navigazione nel Sito. L’installazione dei cookie tecnici non richiede alcun consenso da parte Sua. Ulteriori informazioni sono contenute nella nostra Cookie Policy.

Spain has now the two lists of article 35 GDPR about the requirement of a DPIA

As already announced on the Data Protection Bites 5/2019 release, on 6th of May the Spanish Supervisory Authority (AEPD) published the final list regarding the processing operations subject to the requirement of a Data Protection Impact Assessment (DPIA), in compliance with Article 35 (4) of the GDPR. Around four months later, the AEPD has also published a list of processing activities which do not require a DPIA, making use of this possibility granted by Article 35 (5) of the GDPR.

In compliance with paragraph 4 of Article 35 of the GPDR, the Spanish Supervisory Authority (the “AEPD”) published on the 6th of May this year the list of processing operations which shall be subject to the requirement of a Data Protection Impact Assessment (DPIA).

The AEPD made clear that it constitutes a non-exhaustive list and that when a processing operation fulfils two or more criteria set out on the list, it will most likely need to be subject to a DPIA, “unless such processing operation is included in the list referred to in Article 35.5 of the GDPR of processing operations for which no DPIA is required”.

From such a statement we could already draw the conclusion that the AEPD was planning to work on such a list, although it is set as facultative by the GDPR and not as an obligation of the supervisory authorities such as the list referred to in Article 35 (4).

Last September, the AEPD finally published the referred list of processing activities which do not have to be subject to a DPIA (you can find here the list in the following link- only available in Spanish).

The AEPD rightly explains in this document that "a DPIA is a costly process and it is necessary to apply a principle of economy of means. Therefore, a previous qualitative analysis may conclude that such a DPIA is not necessary. In that case, such a decision must be sufficiently substantiated”.

The AEPD also points out that this list only establishes the processing operations that are exempted from the requirement of a DPIA, but it does not constitute in any way a list of exemptions from the obligations established by the data protection regulations.

This list consists of seven (7) processing operations which do not have to be subject to a DPIA, among which the following can be highlighted:

the processing activities carried out by individual self-employed workers, such as doctors, health professionals or lawyers, as long as the relevant processing operation does not significantly meet two or more criteria set out on the list of processing activities subject to a DPIA, since in such case it is possible that a DPIA may be required; or
processing activities that are mandatory by law and that are carried out in relation to the internal management of SME’s staff, for the purposes of accounting, human resources and payroll management, social security and occupational health; but in no case those processing operations that involve client data.

Contact

Contact Person Picture

Isabel Garcìa Garcìa

+34 91 5359977

Invia richiesta

RÖDL & PARTNER SPAIN

Discover more about our offices in Spain. Read more »

Data Protection Bites

Our newsletter aims at collecting updates, news and insights on data protection matters worldwide, with a special focus on the GDPR.

Read all releases »