In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?

In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?

A. A medical organization that wants to begin genetic testing to support earlier research for which they have performed a DPIA.

B. A data controller who plans to use a new technology product that has already undergone a DPIA by the product’s provider.

C. A marketing team that wants to collect mailing addresses of customers for whom they already have email addresses.

D. A railway operator who plans to evaluate the same video surveillance in all the train stations of his company.

View Answer

Answer: D