Recital 75

Recital 75

General Data Protection Regulation · UE 2016/679

(75)

The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects.

Luxembourg specificity
délibération CNPD n°2018-2019 du 16 novembre 2018 et loi du 1er août 2018 portant organisation de la CNPD

In Luxembourg, the CNPD has published a list of processing operations subject to mandatory DPIA (deliberation no. 2018-2019 of 16 November 2018) which directly operationalises Recital 75: large-scale profiling, biometric data for identification, systematic employee monitoring, large-scale processing of minors' data. The Law of 1 August 2018 organising the CNPD confirms the exclusive competence of the Luxembourg authority to assess the risk level on the territory.

Luxgap practice: we systematically cross-check your register against the CNPD 2018-2019 list during mission scoping, and document in writing the reasoning for each borderline processing operation to build the Article 5(2) accountability evidence.