Privacy Impact Assessment for Large-Scale Monitoring

Overview

GDPR Article 35(3)(c) mandates a DPIA for systematic monitoring of a publicly accessible area on a large scale. The EDPB in WP248rev.01 identifies systematic monitoring as criterion C3, which often combines with other criteria (large scale C4, vulnerable data subjects C7, innovative technology C8) to trigger mandatory DPIA. This skill covers PIA methodology for CCTV/video surveillance, employee monitoring, location tracking, internet/communications monitoring, and behavioural analytics systems.

Regulatory Framework

GDPR Requirements