Konsekvensbedömning avseende dataskydd : Riskanalys möter rättighetskrav

The protection of personal data is a question of high priority within the EU. The General Data Protection Regulation (GDPR), which replaces the Directive 94/46/EC on data protection and shall be uniformly applied in the whole union from the 25th of May 2018, is a sign of this. Since the direct roots of the data protection rules and principles that are expressed in the GDPR are to be found in the article 8.1 of the Charter of Fundamental Rights of the European Union and in the article 16.1 of the Treaty on the Functioning of the European Union, the legal position of the protection of personal data as a fundamental human right is clear. Although this position is somewhat modified in recital 4 of the preamble, where it is stated that the protection of personal data is not an absolute right and that it must be considered in relation to its function in society and balanced against other fundamental rights, there should be no doubt that the protection of personal data has a high legal status in the EU. In broad terms, the GDPR could be regarded as an updating of the concept of protection of human rights and freedoms to the realities of the online era. The extent of processing of personal data in the world of today is huge and it continues to grow rapidly. In the GDPR, that processing is regarded as a risk to natural persons’ rights and freedoms. However, all processing of personal data does not pose the same level of risk to natural persons’ rights and freedoms. The logic of this point has paved the way for the risk-based approach, which plays an important role in determining the responsibilities of the controller and the processor in each individual data processing. The risk-based approach can be expressed as the higher the risk, the higher the security must be. Or, in other words, security measures must follow risk level. The subject matter of this essay is the concept of data protection impact assessment (DPIA), which is regulated by Article 35 of the GDPR. At a certain level of risk, the controller is obliged to carry out a DPIA. There are legal demands to be met, but no explicit method is laid down in the Regulation. The Data Protection Authorities (DPA) of England and France have each developed a method to comply with the demands of Article 35. These methods are examined and their effectiveness in reaching that objective are assessed. The DPA:s of Germany have developed a method to technically operationalize data protection legislation. This method is presented and examined and its capacity as a tool to carry out a DPIA is also assessed. The essay contains two proposals. One in section 2.4 which attempts to clarify the meaning of four commonly used words in data protection terminology. The second proposal is in section 4.1. It compares the legal obligations to be met by data processing that activates the need for a DPIA to the legal obligations of those that do not. The proposal tries to define a work flow which minimizes the extra work if a DPIA has to be carried out.Konsekvensbedömningar avseende dataskydd är en nyhet inom dataskyddslagstiftning. I dem möts riskanalys och rättighetskrav. Konsekvensbedömningar används sedan tidigare på olika sätt inom andra områden, men för dataskyddslagstiftning är det en konceptuell nyhet. De introduceras i artikel 35 i EU:s nya dataskyddsförordning, även känd som GDPR. Artikel 35 är mycket omfattande och inte helt lättöverskådlig. Samtidigt är den från och med 25 maj 2018 gällande rätt. Det innebär att berörda parter, främst personuppgiftsansvariga och personuppgiftsbiträden, är skyldiga att veta vad artikel 35 innebär för deras del. Underlåtelse att utföra en konsekvensbedömning, eller ett felaktigt utförande, kan medföra administrativa sanktionsavgifter på upp till 10 000 000 euro. Uppsatsen undersöker och redovisar förutsättningarna för att bygga en rättsligt kvalitetssäkrad modell avseende när och hur en konsekvensbedömning avseende dataskydd ska genomföras, vad den ska innehålla samt hur en sådan modell kan göras skalbar. Uppsatsen söker visa hur och till vilken grad berörda parter med säkerhet kan veta att de uppfyllt sina skyldigheter enligt artikel 35