The European Data Protection Board has issued an opinion (No 17/2018) on the draft list of the competent supervisory authority of Poland regarding those processing operations subject to the requirement of a data protection impact assessment.
The Urząd Ochrony Danych Osobowych (the Personal Data Protection Office) has submitted its draft list to the EDPB. The decision on the completeness of the file was taken on 20th of June 2018. This period until which the opinion to be adopted was extended until the 25th of September, which took into account the complexity of the subject matter considering that at the same time twenty-two competent supervisory authorities submitted their draft lists and thus the need for a global assessment arose.
The submitted draft list by the Polish authority relates to the offering of goods or services to data subjects, relates to the monitoring of their behaviour in several Member States and may substantially affect the free movement of personal data within the Union mainly because the processing operations in the submitted draft list are not limited to data subjects in the country.
EDPB decided that the draft may lead to an inconsistent application of the requirement for a DPIA and that some changes need to be made.
The opinion is available under the link.
