Are you planning to conduct a survey within your organisation? And do you sometimes wonder when you should or should not carry out a data protection impact assessment (DPIA)?
The Belgian Data Protection Authority (BDPA) published on Monday a decision of its Litigation Chamber that contains various tips in this respect, with a particular focus on the following questions:
- Is personal data (including identification) needed for a survey? [data minimisation]
- Does a privacy link in the footer suffice for information purposes? [information & transparency]
- Is a data protection impact assessment (DPIA) required? [accountability]
Read on for the BDPA's answers.