The data protection impact assessment (DPIA) cannot be a mere formal exercise consisting of reproducing a generic template provided by the processor. It must include a personalized and thorough risk analysis, as well as a material demonstration of the necessity and proportionality test, otherwise the controller fails to comply with its obligations under Article 35 of the GDPR.

Facts and context

The Spanish Data Protection Agency (AEPD) issued a decision declaring an infringement against the CANARIAN FOUNDATION FOR THE PROMOTION OF SPECIAL ADAPTED TRANSPORT for a failure related to conducting a data protection impact assessment.

The case originated from a complaint filed on 30 November 2023 concerning the use of a biometric fingerprint system for monitoring employees' working time, implemented in October 2023.

Reasons for the decision

The authority examined the compliance of the processing, notably regarding the obligation to conduct an impact assessment. Although the investigation initially focused on potential violations of Articles 9 and 35 of the GDPR, the AEPD ultimately dismissed the breach of Article 9, considering that the deficiencies in the impact assessment were the cause of the non-compliant implementation of the processing. The only infringement retained is therefore the following:

• Obligation to conduct a data protection impact assessment (Article 35 of the GDPR): The authority found that the impact assessment provided by the foundation was an almost identical copy of a generic document prepared by its processor (***EMPRESA.1). The document was neither dated nor signed, and was not adapted to the foundation's specific context, even containing references to unused technologies such as facial recognition. The AEPD judged the risk analysis manifestly insufficient, limited to generic tables dismissing obvious risks without justification and proposing abstract mitigation measures such as "security related to human resources" instead of concrete safeguards. Moreover, the evaluation of necessity and proportionality was reduced to a single declarative paragraph, without any analysis of less intrusive alternatives, even though a card system was ultimately implemented. The authority therefore concluded that the document was merely a formal exercise and did not constitute a genuine impact assessment compliant with the requirements of Article 35, paragraph 7, of the GDPR.

Authority's decision

Consequently, the authority issued a declaration of infringement against the FOUNDATION for violation of Article 35 of the GDPR. Due to its status as a public sector foundation, the entity was not subject to a financial penalty, pursuant to Article 77 of the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD).

Furthermore, the authority ordered the notification of its decision to the Ombudsman and its publication.

Lessons learned

This decision reminds that:

• An impact assessment cannot be limited to merely reproducing a generic template provided by a processor; it must be personalized to reflect the context, risks, and specific particularities of the controller's processing.
• The triple test of adequacy, necessity, and proportionality must be materially demonstrated in the impact assessment, concretely evaluating less intrusive alternatives and justifying why they are not retained.
• The risk analysis must identify specific threats to the processing and associate them with concrete and detailed mitigation measures, not abstract categories of measures.