(91) This should apply in particular to large-scale processing operations - which serve to process a significant amount of personal data at the regional, national or supranational level and which are likely to affect a large number of data subjects, and which are likely to give rise to high risks, for example (due to their specific nature) when new technology is used on a large scale in accordance with the state of the art - and to other processing operations that give rise to a high risk of infringing on the rights or freedoms of data subjects, in particular when such operations hinder the exercise of data subjects' rights. A data protection impact assessment should also be performed in cases where personal data is processed for the purpose of making a decision with respect to a specific individual after a systematic, comprehensive assessment of personal factors of individuals based on profiling of such data, or after processing special categories of personal data, biometric data, or personal data relating to criminal convictions, violations of the law or relevant security measures. A data protection impact assessment is also necessary in the case of large-scale monitoring of publicly accessible places - in particular by means of opto-electronic devices - or any other operation in respect of which the competent supervisory authority considers that the processing is likely to result in a high risk of violation of the rights or freedoms of data subjects, in particular because the operations prevent data subjects from exercising a right or enjoying a service or a contract, or are systematic in nature and large in scale. Processing of personal data should not be considered large-scale processing if it involves personal data of patients or clients and is carried out by a single doctor, other health professional or lawyer. In such cases, a data protection impact assessment should not be mandatory.