Where can we find information on processing operations?
ANSWER
As noted during the webinar, the lack of a precise definition leads to information being scattered across sources. Nevertheless, the following sources will help define processing operations and determine how they should be characterised:
- GDPR (Article 4(2), Article 30(1), 35)
- Communication of the President of the Personal Data Protection Office of 17 June 2019 on the list of types of personal data processing operations requiring a data protection impact assessment;
- Guidelines 4/2019 on Article 25 Data protection by design and by default
- Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679
- Guidelines on the implementation of the Court of Justice of the European Union judgment in "Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González" C-131/12.
