Article 4c (data protection impact assessment).

• 1

  Where a type of processing, in particular processing using new technologies, is likely to present a high risk to the rights and freedoms of individuals, having regard to its nature, scope, context or purposes, the controller shall conduct an assessment of the impact of the intended processing activities on the protection of personal data prior to the processing.

• 2

  The assessment includes at least:

  • a.

    A general description of the intended processing operations;

  • b.

    An assessment of the risks to the rights and freedoms of data subjects;

  • c.

    the intended risk reduction measures;

  • d.

    the precautionary and security measures and mechanisms to protect police data and to demonstrate compliance with the provisions of or under this law, while respecting the rights and legitimate interests of data subjects and other persons concerned.

• 3

  If necessary, the controller shall conduct a review to assess whether the processing is carried out in accordance with the data protection impact assessment, at least when there is a change in the risk posed by the processing operations.