Is it necessary to carry out a DPIA when implementing mLegitymacja in a school?

ANSWER

The school is the controller of data of pupils to whom the ID card has been issued. In my view, a DPIA may be necessary, as the criterion of data subjects requiring special protection is met, and special category data may additionally apply (disability information).