What is a DPIA?

Before processing personal data you, as a researcher on behalf of the processing controller UGhent, must assess whether or not the processing is likely to have a high risk for the freedoms and rights of the data subjects. If so, you are obliged to carry out a risk analysis, a so-called Data Protection Impact Assessment (DPIA).

A DPIA is an instrument to identify the privacy risks of data processing within your research prior to the start of the research.

A DPIA subjects your proposed research to an assessment of the potential high risks it may pose to data subjects, in light of all the rights and freedoms they enjoy.

A DPIA may address one particular research, but it may also address a set of similar processing activities that present similar high risks.

When to conduct a DPIA? 

The following criteria or potential risks will help you analyse whether or not your research constitutes a probable high-risk processing:

• Special categories of personal data or personal data of a sensitive nature are processed in this research. This includes special categories of personal data (e.g. information about individuals' political views), as well as personal data relating to criminal convictions or offences.
• Personal data of children or other vulnerable persons (such as employees, the mentally ill, asylum seekers, the elderly, patients) are processed in this research.
• Personal data are processed on a large scale. Always keep in mind the specific research context, such as:
  • the number of data subjects, either as a specific number or as a subset of the relevant population;
  • the volume of personal data collected and/or the number of categories of personal data collected (e.g. are you only collecting names and mail addresses, or also information on hobbies, professional activities, family situation, …?);
  • the retention period (e.g. are the data processed for a limited time period, or will the data be processed for a longer time period, or even on a permanent basis?);
  • the geographical range of the processing activities (multiples countries?).
• Aspects concerning the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behavior, location or movements are evaluated or scored, profiled or predicted. For example: making profiles on the basis of the use or navigation on websites, offering genetic tests to persons for judging and/ or predicting health risks, collecting data of social media for profiling purposes, …
• The data are transferred beyond the borders of the EU or the EEA, or to a country not listed on the ‘white list’. For example: data transfer to researchers outside the EEA; data storage on cloud services established outside the EEA, …
• The research involves datasets that have been or will be matched or combined. This means matching or combining personal data from one or more processing activities with multiple research purposes and/ or by multiple data controllers in a way that would not meet the reasonable expectations of the data subject(s)
• The processing aims at taking decisions producing legal effects concerning the data subject or similarly significant effects for the data subject. For example, the processing may lead to exclusion of or discrimination against individuals. Examples of legal effects: contract termination, grant/ refusal of social benefits, refusal of access to a country, … Examples of significant effects: credit assessment, refusal of access to health care services, employment opportunities or education (e.g. admission to university), profiling (case by case assessment)
• The processing prevents data subjects from exercising a right or using a service or a contract.
• The research involves the systematic monitoring of persons in one or more publicly accessible areas. For example: camera recordings on publicly accessible areas (such as railway stations, streets, market places, public library, …)
• The research involves innovative use or application of technological or organisational solutions, like combining the use of finger print and face recognition for improved physical access control. For example: innovative applications based on artificial intelligence, automated number plate recognition, …
• The research involves the processing of non-pseudonymised personal data. This means that you are processing raw personal data in your research, whereby your research data is not separated from the personal data (e.g. respondents are called by their names).

At Ghent University, the criteria to help you analyse whether or not your research constitutes a probable high-risk processing are embedded in the registration of processing activities (GDPR Record – question 25) via the online planning tool DMPonline.be (see GDPR: how do I register personal data processingactivities?).

If two or more of these criteria apply to the data processing planned in your research, your research constitutes a probable high risk and you need to indicate this in question 26. In this case a Data Protection Impact Assessment or DPIA is advised to further identify the privacy risks related to the processing.

How to conduct a DPIA? 

If two or more risks apply, your research constitutes a probable high risk and you need to complete the ‘DPIA’ section in DMPonline.be. 

We advise you to complete the GDPR Record before you start the DPIA. 

In the DPIA section you will be asked to describe and assess the risks to individuals, assess the necessity, proportionality and to describe the technical and organizational measures taken to mitigate the risks. By completing the questions in the DPIA, you should be able to estimate the impact and the likelihood of the risks in your research. By balancing the impact with the likelihood, you can indicate whether or not there are risks left in your research and whether or not they are acceptable. 

When after conducting the DPIA you come to the conclusion that there are non-acceptable risks left, the DPO (for UGent: privacy@ugent.be; for UZGent: dpo@uzgent.be) must be consulted prior to the start of the processing.

Keep in mind that the DPIA should be conducted before the processing and should be considered as a living tool, not merely as a one-off exercise. 

For research at / in collaboration with UZGent: Since a DPIA can also relate to a series of comparable processing activities (or research projects) that entail comparable high risks, one DPIA can be created / used for this. A DPIA template has already been developed for retrospective and prospective research carried out at Ghent University Hospital. These templates can be consulted at the UZGent intranet and used as inspiration to complete the DPIA section in DMPonline.be.

More information

• Privacy and research