Impact assessment and prior consultation

What an impact assessment is

A data protection impact assessment is the analysis the controller carries out before high-risk processing, to assess the impact of the envisaged processing operations on the protection of personal data art. 35(1). The Law sets the minimum content of the assessment art. 35(7), and the controller must be able to demonstrate that processing complies with the Law art. 24(1).

When it is required

The obligation is not general. The controller carries out an assessment where, taking into account the nature, scope, context and purposes of the processing, a type of processing, in particular one using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons art. 35(1). The Law names three situations in which an assessment is required in particular:

• a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based art. 35(3)(a);
• processing on a large scale of special categories of data or of data relating to criminal convictions and offences art. 35(3)(b);
• systematic monitoring of a publicly accessible area on a large scale art. 35(3)(c).

The National Centre for Personal Data Protection approves the list of types of processing operations that require an assessment art. 35(4) and may approve a list of those for which none is required art. 35(5). The lists are published in the Official Gazette of the Republic of Moldova (Monitorul Oficial) and on the Centre’s website art. 35(6).

A single assessment may cover a set of similar operations that present similar high risks art. 35(1). For processing based on a legal obligation or a task in the public interest, no assessment is needed if one has already been carried out as part of a general impact assessment when the normative acts providing for the processing were adopted, unless those acts require one before the processing art. 35(10).

Who is involved

If a data protection officer has been designated, the controller seeks his or her advice art. 35(2). Where appropriate, the controller also seeks the views of data subjects or their representatives art. 35(9). Compliance with an approved code of conduct is duly taken into account in assessing the impact art. 35(8).

An assessment is not a one-off exercise: where necessary, the controller reviews whether the processing is carried out in accordance with it, at least when the risk changes art. 35(11).

Prior consultation of the Centre

The controller consults the Centre before processing where the assessment indicates that the processing would result in a high risk in the absence of measures taken to mitigate it art. 36(1). In doing so, it provides the information required by the Law, including the impact assessment art. 36(3).

If the Centre considers that the intended processing would infringe the Law, it provides the controller with written advice within eight weeks of receipt of the request, a period that may be extended by six weeks depending on complexity. The Centre may also use any of its powers art. 36(2), art. 60.

Why it matters

Infringements of the obligations on impact assessment and prior consultation are punishable by fines of up to 1,000,000 lei or, for an enterprise, of up to 1% of the total turnover achieved in the year preceding the imposition of the sanction, whichever is higher art. 88(1)(a).