The controller must always carry out a detailed assessment of the impact on personal data protection if it performs at least one processing operation from the list published by the Office for Personal Data Protection. Specifically:
- Processing of biometric data of natural persons for the purpose of individual identification
- Processing of genetic data of natural persons
- Processing of location data
- Processing operations carried out in accordance with Article 14 of the General Data Protection Regulation.
- Evaluation or scoring.
- Credibility assessment.
- Solvency assessment.
- Profiling.
- Monitoring of an employee's work on the basis of serious reasons arising from the specific nature of the employer's activities (control mechanism within the meaning of the Labor Code).
- Processing of personal data for scientific or historical research purposes without consent
- Processing operations using new or innovative technologies
- Systematic camera monitoring of public spaces (in individual cities, municipalities, and by urban and suburban public transport operators).
- Surveillance of persons by private detective or security services.
The service includes: