DPIA with ChatGPT: the intake in four steps

A DPIA is required when processing personal data is likely to result in a high risk to the rights and freedoms of people. You carry it out before the processing starts (Article 35(1) GDPR).

The GDPR names three cases in which a DPIA is required in any event: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; large scale processing of special categories of data or criminal offence data; and systematic monitoring of a publicly accessible area on a large scale (Article 35(3)).

Each supervisory authority also publishes a list of processing operations that require a DPIA (Article 35(4)). The list of the Dutch Data Protection Authority names seventeen, such as fraud prevention, credit scores, profiling, camera surveillance, employee monitoring and biometric data. The list is not exhaustive.

If your processing is not on the list, the nine criteria in the DPIA guidelines of the European data protection authorities help: processing that meets two or more of them requires a DPIA in most cases. The Praxikon case check follows that order: Article 35(3)(a) and (b), the list, then the criteria.

A FRIA (Article 27 AI Act) stands next to it. It applies only to the deployer of a high-risk AI system under Annex III, and then only to bodies governed by public law, private entities providing public services, and deployers using the system to evaluate the creditworthiness or credit score of natural persons (not to detect financial fraud) or for risk assessment and pricing of natural persons in life and health insurance. Critical infrastructure (Annex III point 2) is excluded. Where the DPIA already meets an obligation of the FRIA, you may cross-refer to those parts or include them in the FRIA (Article 27(4)).