Which national DPIA lists already catch AI.

Item 1

Large-scale, non-sporadic processing of biometric data for unique identification.

Мащабно обработване на биометрични данни за целите на уникалната идентификация на физическо лице, което не е спорадично.

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) where an AI remote biometric identification system is used.

Item 2

Genetic data processed for profiling with legal or similarly significant effects.

Обработване на генетични данни с цел профилиране, което поражда правни последици за субекта на данни или по подобен начин го засяга в значителна степен.

• Profiling or scoring
• Automated decisions
• Health data

Item 3

Location data processed for profiling with legal or similarly significant effects.

Обработване на данни за местоположение с цел профилиране, което поражда правни последици за субекта на данни или по подобен начин го засяга в значителна степен.

• Profiling or scoring
• Automated decisions
• Large-scale monitoring

Item 7

Children's data in information-society services offered directly to a child.

Обработване на лични данни на деца при пряко предлагане на услуги на информационното общество.

• Children

Item 8

Migration of data from existing to new technologies linked to large-scale processing.

Осъществяване на миграция на данни от съществуващи към нови технологии, когато това е свързано с мащабно обработване на данни.

• New technology

Item 8 (8.1)

Characteristic 8, processing in technically complex or advanced infrastructures or platforms. Its highest (critical, red) level is 'automated expert systems including artificial intelligence' (systems for analysis and profiling).

Zpracování osobních údajů v technologicky složitých nebo pokročilých infrastrukturách nebo platformách; 8.1 Automatizované expertní systémy, včetně umělé inteligence

• AI named
• Profiling or scoring
• New technology

Item 6 (6.1)

Characteristic 6, processing the data subject cannot influence. The critical level covers processing the data subject cannot influence, typically processing on a legal basis or resulting from automated decision-making.

Zpracování osobních údajů s omezeným ovlivněním subjekty údajů; 6.1 Subjektem údajů neovlivnitelné zpracování a předání

• Automated decisions

Item 1 (1.1)

Characteristic 1, processing that includes monitoring of data subjects. Critical level: identified/identifiable and localisable subjects (tracking of movement or location), including employee monitoring that determines movements or continuously monitors activity.

Zpracování zahrnující monitorování subjektů údajů; 1.1 Subjekty údajů jsou identifikovatelné/identifikované a lokalizovatelné

• Large-scale monitoring
• Employee monitoring

Item 2 (2.1)

Characteristic 2, critical data (red) include special category data such as biometric data processed for unique identification, 'including biometric cameras and similar devices', and health data.

Zpracování kritických údajů, údajů umožňujících přímou identifikaci a/nebo údajů vysoce osobní povahy; 2.1 Kritické údaje

• Biometrics
• Health data

Item 10 (10.1)

Characteristic 10, use of new technological or organisational solutions. Critical level: a completely new solution with no prior experience.

Zpracování osobních údajů s využitím nových technologických nebo organizačních řešení; 10.1 Zcela nové řešení

• New technology

Item 1

Profiling (restating Art. 35(3)(a)): evaluation of persons by automated processing, extensively and systematically, with legal or similarly significant effects.

Esimene näide on profileerimine - vastutav töötleja / volitatud töötleja hindab inimesi: automatiseeritud andmetöötlemist kasutades, ulatuslikult, süstemaatiliselt ning selline hindamine on inimesele õiguslike tagajärgedega või olulise mõjuga.

• Profiling or scoring
• Automated decisions

Item 3

Large-scale systematic monitoring of publicly accessible areas (restating Art. 35(3)(c)).

Kolmas näide on avalike alade ulatuslik süstemaatiline jälgimine.

• Large-scale monitoring

Item 4

Large-scale processing of biometric data for unique identification.

Biomeetriliste andmete ulatuslik töötlemine füüsilise isiku ainulaadse identifitseerimise eesmärgil.

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) covers remote biometric identification; verification-only uses are excluded.

Item 6

Large-scale processing in an employment context involving systematic monitoring of employees' activities.

Tööhõive kontekstis ulatuslik andmete töötlemine hõlmates töötajate tegevuste süstemaatilist jälgimist.

• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) (monitoring performance and behaviour in work relationships) where an AI system is used.

Item 10

Large-scale processing involving real-time location tracking (particularly communication services).

Toob kaasa asukoha jälgimise reaalajas (eriti sideteenuste puhul).

• Large-scale monitoring

Item 12

Large-scale processing that may pose a risk of discrimination with legal or similar effects, particularly in labour brokering and in assessment services affecting pay and career.

Võib kujutada diskrimineerimise ohtu, millel on õiguslikud tagajärjed või millel on sarnane mõju (eriti tööjõu vahendamise ning palka ja karjääri mõjutavate hindamisteenuste puhul).

• Profiling or scoring

Annex III overlap: 4. Employment and workers’ management. Labour brokering and assessment affecting pay and career correspond to Annex III point 4(a)/(b) where an AI system is used.

Item Biometriset tiedot

Biometric data processed for unique identification, with at least one further WP248 criterion (scoring, automated decisions, systematic monitoring, large scale, matching, vulnerable subjects, innovative use, preventing rights).

Biometriset tiedot

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) where an AI remote biometric identification system is used.

Item Geneettiset tiedot

Genetic data with at least one further criterion (incl. evaluation or scoring, automated decisions).

Geneettiset tiedot

• Health data
• Profiling or scoring

Item Sijaintitiedot

Location data with at least one further criterion (incl. scoring, automated decisions, systematic monitoring).

Sijaintitiedot

• Large-scale monitoring
• Profiling or scoring

Item 1

Health data processing by healthcare or medico-social establishments for patient care. French examples include 'algorithmes de prise de décision médicale' (medical decision-making algorithms) and telemedicine.

Traitements de données de santé mis en œuvre par les établissements de santé ou les établissements médico-sociaux pour la prise en charge des personnes.

• Health data
• Vulnerable people

Item 3

Profiling for human-resources purposes. French examples: detecting 'high potentials'; facilitating recruitment 'notamment grâce à un algorithme de sélection'; personalised training 'grâce à un algorithme'; predicting employee departures from correlations.

Traitements établissant des profils de personnes physiques à des fins de gestion des ressources humaines

• Profiling or scoring
• Vulnerable people

Annex III overlap: 4. Employment and workers’ management. Recruitment via a selection algorithm and employee evaluation correspond to Annex III point 4(a)/(b).

Item 4

Constant monitoring of employees' activity. Examples: data loss prevention analysis of outgoing e-mail, video surveillance of staff handling cash or of warehouse workers, tachographs.

Traitements ayant pour finalité de surveiller de manière constante l'activité des employés concernés

• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) where an AI system is used.

Item 8

Profiling that may lead to exclusion from, suspension or termination of a contract. Examples laid out beside this row in the CNIL PDF: a score for granting credit; behavioural analysis to detect 'prohibited' behaviour on a social network; payment-fraud prevention.

Traitements impliquant le profilage des personnes pouvant aboutir à leur exclusion du bénéfice d'un contrat ou à la suspension voire à la rupture de celui-ci

• Profiling or scoring
• Automated decisions

Annex III overlap: 5. Essential private and public services. Credit scoring example corresponds to Annex III point 5(b); fraud detection is excluded from 5(b). Row-to-example mapping read from the PDF layout.

Item 9

Pooled processing of established contractual breaches that may lead to exclusion or suspension from a contract (criteria include automated decision-making with legal or similar effect). Examples: sector-shared registers of unpaid bills; car-insurance cancellation checks.

Traitements mutualisés de manquements contractuels constatés, susceptibles d'aboutir à une décision d'exclusion ou de suspension du bénéfice d'un contrat

• Automated decisions

Item 10

Profiling using data from external sources. Examples: data broker combinations; personalised online advertising.

Traitements de profilage faisant appel à des données provenant de sources externes

• Profiling or scoring

Item 11

Biometric processing for unique identification where data subjects include vulnerable persons (pupils, elderly, patients, asylum seekers). Examples: fingerprint check of patient identity; school canteen access by hand-contour recognition.

Traitements de données biométriques aux fins d'identifier une personne physique de manière unique parmi lesquelles figurent des personnes dites « vulnérables » (élèves, personnes âgées, patients, demandeurs d'asile, etc.)

• Biometrics
• Vulnerable people
• Children

Annex III overlap: 1. Biometrics. Annex III point 1 where an AI biometric identification system is used; access-control verification is excluded from 1(a). Title as extracted from the CNIL PDF layout.

Item 12

Evaluation of applications for social housing and its management (criteria: sensitive data, evaluation/scoring).

Instruction des demandes et gestion des logements sociaux

• Profiling or scoring

Item 14

Large-scale processing of location data (e.g. mobile apps collecting geolocation, urban mobility services, telecom customer databases, transport ticketing).

Traitements de données de localisation à large échelle

• Large-scale monitoring

Item 1

Biometric data for unique identification where at least one further WP248 criterion applies (e.g. fingerprint access control, school canteen 'payment by fingerprint').

Verarbeitung von biometrischen Daten zur eindeutigen Identifizierung natürlicher Personen, wenn mindestens ein weiteres folgendes Kriterium aus WP 248 Rev. 01 zutrifft

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) where an AI remote biometric identification system is used; access-control verification excluded.

Item 4

Large-scale processing of location data (car sharing, vehicle sensors, offline tracking of customers, mobile-network traffic analysis).

Umfangreiche Verarbeitung von personenbezogenen Daten über den Aufenthalt von natürlichen Personen

• Large-scale monitoring

Item 5

Large-scale merging of data from several sources using algorithms incomprehensible to data subjects, producing data bases for decisions with legal or similarly significant effects. Fields: fraud prevention, scoring by credit agencies, banks or insurers.

Zusammenführung von personenbezogenen Daten aus verschiedenen Quellen und Verarbeitung der so zusammengeführten Daten, sofern ... die Anwendung von Algorithmen einschließen, die für die betroffenen Personen nicht nachvollziehbar sind, und der Erzeugung von Datengrundlagen dienen, die dazu genutzt werden können, Entscheidungen zu treffen, die Rechtswirkung ... entfalten

• Profiling or scoring
• Automated decisions

Annex III overlap: 5. Essential private and public services. Credit-agency and bank scoring correspond to Annex III point 5(b); insurance scoring overlaps 5(c) only for life and health insurance; fraud prevention excluded from 5(b).

Item 6

Mobile optical-electronic recording in public areas where data are centrally consolidated on a large scale (e.g. vehicle environment sensors used to improve automated-driving algorithms).

Mobile optisch-elektronische Erfassung personenbezogener Daten in öffentlichen Bereichen, sofern die Daten aus ein oder mehreren Erfassungssystemen in großem Umfang zentral zusammengeführt werden.

• Large-scale monitoring
• New technology

Item 7

Large-scale collection and publication or transfer of data used to evaluate behaviour and personal aspects, usable by third parties for decisions with legal effect (rating portals, debt collection).

Umfangreiche Erhebung und Veröffentlichung oder Übermittlung von personenbezogenen Daten, die zur Bewertung des Verhaltens und anderer persönlicher Aspekte von Personen dienen...

• Profiling or scoring

Item 8

Large-scale processing of data on employee conduct that can be used to evaluate their work with legal or similarly significant effects (DLP systems profiling employees, geolocation of employees).

Umfangreiche Verarbeitung von personenbezogenen Daten über das Verhalten von Beschäftigten, die zur Bewertung ihrer Arbeitstätigkeit derart eingesetzt werden können, dass sich Rechtsfolgen für die Betroffenen ergeben...

• Employee monitoring
• Profiling or scoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) (monitor and evaluate performance and behaviour) where an AI system is used.

Item 9

Comprehensive profiles of interests, personal networks or personality (dating portals, large social networks).

Erstellung umfassender Profile über die Interessen, das Netz persönlicher Beziehungen oder die Persönlichkeit der Betroffenen

• Profiling or scoring

Item 10

Large-scale merging of data using algorithms incomprehensible to data subjects to discover previously unknown connections for undetermined purposes (big data analysis of customer data enriched by third parties).

Zusammenführung von personenbezogenen Daten aus verschiedenen Quellen ... die Anwendung von Algorithmen einschließen, die für die betroffenen Personen nicht nachvollziehbar sind, und der Entdeckung vorher unbekannter Zusammenhänge zwischen den Daten für nicht im Einzelnen bestimmte Zwecke dienen

• Profiling or scoring
• New technology

Item 11

Use of artificial intelligence to process personal data to steer interaction with data subjects or to evaluate their personal aspects (customer support via AI; call centre automatically evaluating callers' mood; conversational system advising customers).

Einsatz von künstlicher Intelligenz zur Verarbeitung personenbezogener Daten zur Steuerung der Interaktion mit den Betroffenen oder zur Bewertung persönlicher Aspekte der betroffenen Person

• AI named
• Profiling or scoring
• New technology

Item 12

Non-intended use of mobile phone sensors or radio signals to determine location or movement over a substantial period (WLAN/Bluetooth tracking of passers-by).

Nicht bestimmungsgemäße Nutzung von Sensoren eines Mobilfunkgeräts im Besitz der betroffenen Personen oder von Funksignalen ... zur Bestimmung des Aufenthaltsorts oder der Bewegung von Personen über einen substantiellen Zeitraum

• Large-scale monitoring

Item 13

Automated evaluation of video or audio recordings to assess personality (telephone call evaluation using algorithms; call centre mood evaluation).

Automatisierte Auswertung von Video- oder Audio-Aufnahmen zur Bewertung der Persönlichkeit der Betroffenen

• Profiling or scoring
• Automated decisions

Item 14

Comprehensive profiles of movement and purchasing behaviour (customer cards, loyalty schemes).

Erstellung umfassender Profile über die Bewegung und das Kaufverhalten von Betroffenen

• Profiling or scoring

Item 17

Special-category or criminal data (even not large scale) used by providers of new technologies to determine persons' performance (fitness wristband data).

Verarbeitung von Daten gemäß Art. 9 Abs. 1 und Art. 10 DS-GVO ... sofern die Daten durch die Anbieter neuer Technologien dazu verwendet werden, die Leistungsfähigkeit der Personen zu bestimmen.

• New technology
• Health data
• Profiling or scoring

Item 1.1

Systematic evaluation, scoring, prediction and profiling, especially of economic situation, health, preferences, reliability, behaviour, location or credit rating. Examples: financial institution screening customers against credit reference, AML/CTF or fraud data; direct-to-consumer genetic tests.

Συστηματική αξιολόγηση, βαθμολόγηση, πρόβλεψη, πρόγνωση και κατάρτιση προφίλ...

• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Credit rating named in the item corresponds to Annex III point 5(b); Annex III 5(b) excludes fraud detection.

Item 1.2

Systematic processing aimed at automated decisions with legal or similarly significant effects that may lead to exclusion or discrimination. Examples: automatic refusal of an online credit application, e-recruiting without human intervention, automatic refusal of insurance.

Συστηματική επεξεργασία δεδομένων που αποσκοπεί στη λήψη αυτοματοποιημένων αποφάσεων...

• Automated decisions

Annex III overlap: 5. Essential private and public services · 4. Employment and workers’ management. Online credit refusal (Annex III 5(b)); e-recruiting without human intervention (Annex III 4(a)); insurance refusal only overlaps 5(c) for life and health insurance.

Item 1.3

Systematic processing that may prevent exercise of rights or use of a service or contract, especially with third-party data. Examples: bank screening against a credit reference database for a loan; blacklists; whistleblowing systems.

Συστηματική επεξεργασία δεδομένων που ενδέχεται να εμποδίζει το υποκείμενο να ασκήσει τα δικαιώματα του ή να χρησιμοποιήσει μια υπηρεσία ή σύμβαση...

• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Loan decision via credit reference database corresponds to Annex III point 5(b).

Item 1.4

Systematic profiling for marketing where data are combined with third-party data.

Συστηματική επεξεργασία δεδομένων που αφορά την κατάρτιση προφίλ για το σκοπό της προώθησης προϊόντων και υπηρεσιών...

• Profiling or scoring

Item 1.5

Large-scale systematic monitoring of persons via video surveillance, networks or other means in public or publicly accessible areas, incl. location tracking, wi-fi tracking and drones.

Συστηματική και σε μεγάλη κλίμακα επεξεργασία για την παρακολούθηση, την παρατήρηση ή τον έλεγχο των φυσικών προσώπων...

• Large-scale monitoring

Item 2.1

Large-scale processing of special categories (incl. genetic and biometric data for unique identification) and criminal data.

Μεγάλης κλίμακας επεξεργασία των ειδικών κατηγοριών δεδομένων (περιλαμβανομένων των γενετικών και των βιομετρικών με σκοπό την αδιαμφισβήτητη ταυτοποίηση προσώπου)...

• Biometrics
• Health data

Item 2.3

Systematic monitoring (where lawful) of employees' location and of the content and metadata of their communications (example: DLP systems); systematic processing of employees' biometric data for unique identification and of genetic data.

Συστηματική παρακολούθηση - εφόσον είναι επιτρεπτή - της θέσης/τοποθεσίας καθώς και του περιεχομένου και των μεταδεδομένων των επικοινωνιών των εργαζομένων...

• Employee monitoring
• Biometrics

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) (monitoring behaviour of workers) where an AI system is used.

Item 3.1

Innovative use of new technological or organisational solutions, e.g. combined fingerprint and face recognition for access control, mHealth or other 'smart' apps that build user profiles, artificial intelligence applications, public blockchains containing personal data. Applies with a 1st- or 2nd-category criterion.

Καινοτόμος χρήση ή εφαρμογή νέων τεχνολογιών ή οργανωτικών λύσεων... ή εφαρμογές τεχνητής νοημοσύνης ή τεχνολογίες δημόσια προσπελάσιμων blockchain που περιλαμβάνουν προσωπικά δεδομένα.

• AI named
• New technology
• Biometrics

Item 1

Biometric data for unique identification used for systematic monitoring.

Ha egy természetes személy egyedi azonosítását célzó biometrikus adatának kezelése módszeres megfigyelésre irányul.

• Biometrics
• Large-scale monitoring

Annex III overlap: 1. Biometrics. Biometric identification for systematic monitoring corresponds to Annex III point 1(a) remote biometric identification where an AI system is used.

Item 2

Biometric identification of vulnerable data subjects, in particular children, employees, the elderly and mentally ill people.

Ha kiszolgáltatott helyzetben lévő érintettekkel ... kapcsolatos egyedi azonosítását célzó biometrikus adat kezelése történik.

• Biometrics
• Vulnerable people
• Children

Annex III overlap: 1. Biometrics. Annex III point 1 where an AI biometric identification system is used; verification-only uses excluded.

Item 5

Scoring: assessing characteristics of the data subject where the result affects the creation or quality of a service provided to them.

Pontozás.

• Profiling or scoring

Item 6

Creditworthiness assessment through large-scale or systematic evaluation of personal data.

Hitelképesség értékelése.

• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Annex III point 5(b) (creditworthiness / credit score).

Item 7

Solvency assessment through large-scale or systematic evaluation of personal data.

Fizetőképesség értékelése.

• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Annex III point 5(b) (creditworthiness).

Item 8

Use of data collected from third parties in decisions to refuse or terminate a service.

Harmadik személytől gyűjtött adatok további felhasználása.

• Automated decisions
• Profiling or scoring

Item 9

Use of pupils' and students' data for assessment: recording and examining preparedness, achievement, aptitude and mental state, where not required by law, at any level of education.

Diákok, hallgatók személyes adatainak értékelésre való felhasználása.

• Profiling or scoring
• Children
• Vulnerable people

Annex III overlap: 3. Education and vocational training. Annex III point 3(b) (evaluating learning outcomes) where an AI system is used.

Item 10

Profiling through large-scale and systematic evaluation, especially of work performance, financial status, health, preferences, trustworthiness, conduct, residence or movement.

Profilozás.

• Profiling or scoring

Item 11

Anti-fraud: screening clients against credit reference, AML/CTF and anti-fraud databases.

Csalás elleni fellépés.

• Profiling or scoring

Item 13

Automated decision-making with legal or similarly significant effects, which may result in exclusion or discrimination.

Joghatással vagy hasonló jelentős hatással járó automatizált döntéshozatal.

• Automated decisions

Item 14

Systematic, large-scale surveillance in public areas by cameras, drones or other new technology (wifi tracking, Bluetooth tracking, body cameras).

Módszeres megfigyelés.

• Large-scale monitoring
• New technology

Item 16

Monitoring of employees' work: large-scale, systematic processing and assessment of employees' data (e.g. GPS trackers in vehicles, camera surveillance against theft or fraud).

Munkavállaló munkájának megfigyelése.

• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) where an AI system is used.

Item 18

Processing large amounts of personal data for law enforcement purposes.

Nagyszámú személyes adatok kezelése bűnüldözési célból

Annex III overlap: 6. Law enforcement. Same domain as Annex III point 6; Annex III lists only specific law-enforcement AI uses (risk assessment, polygraphs, evidence reliability, profiling).

Item 20

Children's data for profiling, automated decision-making, marketing or information-society services offered directly to them.

Gyermekek személyes adatainak kezelése profilozás, automatikus döntéshozatal, vagy marketing céljából...

• Children
• Profiling or scoring
• Automated decisions

Item 21

Use of new technologies: large amounts of data from sensor-equipped devices (smart TVs, smart appliances, smart toys) that feed profiling of financial status, health, interests, trustworthiness, conduct, residence.

Új technológiai megoldások használata az adatkezelés során.

• New technology
• Profiling or scoring

Item 1

Data collected from third parties combined with at least one other criterion, e.g. combining third-party data to decide whether to offer, continue or deny a product, service or offer; systematic combining of telecom location/traffic data.

Gagnaöflun frá þriðja aðila í samhengi við a.m.k. einn af framangreindum flokkum í 2. gr.

• Profiling or scoring
• Automated decisions

Item 2

Large-scale systematic monitoring, incl. camera surveillance, in publicly accessible areas.

Umfangsmikið kerfisbundið eftirlit, að meðtalinni myndavélavöktun, á svæðum opnum almenningi.

• Large-scale monitoring

Item 3

Electronic monitoring in schools or kindergartens during opening hours.

Rafrænt eftirlit við skóla eða leikskóla á skóla-/vistunartíma.

• Large-scale monitoring
• Children

Item 4

Processing to evaluate pupils' performance, well-being or welfare at all levels of education, from preschool to university.

Vinnsla persónuupplýsinga í því skyni að leggja mat á árangur, líðan eða velferð nemenda í skóla eða leikskóla.

• Profiling or scoring
• Children
• Vulnerable people

Annex III overlap: 3. Education and vocational training. Annex III point 3(b) (evaluating learning outcomes) where an AI system is used.

Item 5

Biometric data to identify or verify a person uniquely, combined with at least one other criterion (e.g. large-scale biometric processing).

Vinnsla lífkennaupplýsinga í því skyni að greina eða staðfesta deili á einstaklingi með ótvíræðum hætti...

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) excludes verification-only uses; the Icelandic item covers both identification and verification.

Item 7

Monitoring employees' work output or behaviour (e.g. internet use, electronic communications, camera surveillance).

Vinnsla persónuupplýsinga sem felur í sér vöktun vinnuskila eða hegðunar starfsmanna.

• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) where an AI system is used.

Item 8

New technology, or old technology used in a new way, combined with at least one other criterion (e.g. health data from implantable medical devices).

Vinnsla persónuupplýsinga þar sem beitt er nýrri tækni eða eldri tækni er beitt á nýjan hátt...

• New technology
• Health data

Item 9

Systematic evaluation of proficiency, skills, test results, mental health or development.

Vinnsla persónuupplýsinga í því skyni að leggja, með kerfisbundnum hætti, mat á færni, hæfni, útkomu úr prófunum, andlega heilsu eða þroska.

• Profiling or scoring
• Health data

Item 11

Providing services or developing commercial products that predict working capacity, economic status, health, opinions or interests, reliability, behaviour, location or routes, combined with at least one other criterion.

Vinnsla persónuupplýsinga í þeim tilgangi að veita þjónustu eða þróa vörur ætlaðar til notkunar í viðskiptatilgangi, þar sem spáð er fyrir um starfsgetu, efnahagslega stöðu, heilsu...

• Profiling or scoring

Item 12

Large-scale processing of sensitive or highly personal data for the purpose of developing algorithms (English EDPB version: 'for training of algorithms').

Umfangsmikil vinnsla með viðkvæmar persónuupplýsingar, eða aðrar persónuupplýsingar viðkvæms eðlis, í því skyni að þróa algrím.

• New technology
• Health data

Item 13

Large-scale collection via the Internet of Things or solutions that monitor people's condition and movement, such as smartwatches.

Umfangsmikil söfnun persónuupplýsinga, sem fer fram í gegnum „Internet hlutanna“ eða lausnir sem fylgjast með ástandi og hreyfingu einstaklinga, svo sem snjallúr.

• New technology
• Large-scale monitoring
• Health data

Item 14

Processing that prevents exercise of a right or access to credit, a service or a contract, combined with one other criterion (e.g. a financial institution checking creditworthiness to decide on a loan).

Vinnsla persónuupplýsinga sem kemur í veg fyrir að hinn skráði fái notið tiltekinna réttinda eða fái fyrirgreiðslu, þjónustu eða samning...

• Automated decisions
• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Annex III point 5(b) (creditworthiness).

Item 2

Profiling vulnerable persons, including children, to target marketing or online services at them.

Profiling vulnerable persons including children to target marketing or online services at such persons.

• Children
• Vulnerable people
• Profiling or scoring

Item 3

Use of profiling, algorithmic means or special category data to determine access to services, or with legal or similarly significant effects.

Use of profiling or algorithmic means or special category data as an element to determine access to services or that results in legal or similarly significant effects.

• Automated decisions
• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Item names 'access to services'; Annex III point 5 is limited to essential private and public services and benefits (incl. creditworthiness and life/health insurance pricing), so the overlap is partial.

Item 4

Systematic monitoring, tracking or observation of individuals' location or behaviour.

Systematically monitoring, tracking or observing individuals' location or behaviour.

• Large-scale monitoring

Item 5

Large-scale profiling of individuals.

Profiling individuals on a large-scale.

• Profiling or scoring

Item 6

Biometric identification or authentication combined with any other WP248 criterion.

Processing biometric data to uniquely identify an individual or individuals or enable or allow the identification or authentication of an individual or individuals in combination with any of the other criteria set out in WP29 DPIA Guidelines.

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) excludes biometric verification whose sole purpose is to confirm identity; the Irish item also covers authentication.

Item 9

Combining or cross-referencing separate datasets where this is used for profiling or behavioural analysis, especially across sources, purposes or controllers.

Combining, linking or cross-referencing separate datasets where such linking significantly contributes to or is used for profiling or behavioural analysis of individuals...

• Profiling or scoring

Item 1

Large-scale evaluation or scoring, profiling and predictive activities, also online or via apps, on work performance, economic situation, health, preferences, reliability, behaviour, location or movements.

Trattamenti valutativi o di scoring su larga scala, nonché trattamenti che comportano la profilazione degli interessati nonché lo svolgimento di attività predittive...

• Profiling or scoring

Item 2

Automated processing to take decisions with legal or similarly significant effects, including decisions preventing use of a good or service or continuation of a contract (e.g. screening bank customers using credit bureau data).

Trattamenti automatizzati finalizzati ad assumere decisioni che producono "effetti giuridici" oppure che incidono "in modo analogo significativamente" sull'interessato... (ad es. screening dei clienti di una banca attraverso l'utilizzo di dati registrati in una centrale rischi).

• Automated decisions

Annex III overlap: 5. Essential private and public services. The credit-bureau screening example corresponds to Annex III point 5(b) (creditworthiness).

Item 3

Systematic use of data to observe, monitor or control data subjects, incl. network/online collection, unique identifiers of information-society service users over long periods, and metadata processing.

Trattamenti che prevedono un utilizzo sistematico di dati per l'osservazione, il monitoraggio o il controllo degli interessati...

• Large-scale monitoring

Item 5

Processing in the employment relationship through technological systems (incl. video surveillance and geolocation) enabling remote monitoring of employees' activity.

Trattamenti effettuati nell'ambito del rapporto di lavoro mediante sistemi tecnologici (anche con riguardo ai sistemi di videosorveglianza e di geolocalizzazione) dai quali derivi la possibilità di effettuare un controllo a distanza dell'attività dei dipendenti...

• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) (monitoring behaviour of workers) where an AI system is used.

Item 7

Processing with innovative technologies (e.g. IoT, artificial intelligence systems, online voice assistants, wearable monitoring, proximity tracking such as wi-fi tracking) whenever at least one other WP248 criterion is met.

Trattamenti effettuati attraverso l'uso di tecnologie innovative, anche con particolari misure di carattere organizzativo (es. IoT; sistemi di intelligenza artificiale; utilizzo di assistenti vocali on-line attraverso lo scanning vocale e testuale; monitoraggi effettuati da dispositivi wearable; tracciamenti di prossimità come ad es. il wi-fi tracking) ogniqualvolta ricorra anche almeno un altro dei criteri individuati nel WP 248, rev. 01.

• AI named
• New technology

Item 11

Systematic processing of biometric data (clarified as biometric data for unique identification), considering volume, duration or persistence.

Trattamenti sistematici di dati biometrici, tenendo conto, in particolare, del volume dei dati, della durata, ovvero della persistenza, dell'attività di trattamento.

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1 covers AI biometric identification, categorisation and emotion recognition; the item covers biometric processing generally.

Item 5

Surveillance of data subjects when large-scale, at the workplace, or directed at vulnerable subjects (health care, social care, prisons, educational institutions, workplace).

Datu subjekta uzraudzība, kas tiek veikta šādos gadījumos: a. ja to veic plašā apjomā; b. ja to veic darbavietā; c. ja tā attiecināma uz īpaši aizsargājamiem datu subjektiem...

• Large-scale monitoring
• Employee monitoring
• Vulnerable people

Item 6

Processing using innovative technologies, mechanisms or methods, combined with at least one criterion.

Datu apstrāde, izmantojot inovatīvas tehnoloģijas, mehānismus vai metodes, kopā ar vismaz vienu no Kritērijiem.

• New technology

Item 7

Monitoring (observation) of employees; English EDPB version: 'measures for systematic monitoring of employee activities'.

Darbinieku novērošana.

• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) where an AI system is used.

Item 8

Large-scale tracking of data subjects, incl. lifestyle apps or logistics companies.

Plaša mēroga datu subjektu izsekošana, tostarp dzīvesveida lietotnes vai loģistikas uzņēmumi.

• Large-scale monitoring

Item 10

Information-society services offered directly to a child.

Datu apstrāde attiecināma uz informācijas sabiedrības pakalpojumu piedāvājumu tieši bērnam.

• Children

Item 11

Large-scale automated processing and processing based on profiling.

Automātiska personas datu apstrāde plašā mērogā un datu apstrāde, kā pamatā ir profilēšana.

• Automated decisions
• Profiling or scoring

Item 13

Biometric data to identify a person, combined with at least one criterion.

Biometrisko datu apstrāde ar mērķi identificēt fizisku personu, kopā ar vismaz vienu no Kritērijiem.

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) where an AI remote biometric identification system is used.

Item 2

Systematic processing using innovative technologies plus one further criterion. 2020 German examples: building and home automation; autonomous driving; intelligent transport systems; medical telemetry; 'Künstliche Intelligenz und Deep-Learning-Technologien'; image recognition. (2019 English EDPB version: 'Deep learning platforms; Image recognition'.)

Systematische Verarbeitung unter Einsatz von innovativen Technologien, wenn zusätzlich mindestens ein weiteres Kriterium der europäischen Leitlinien erfüllt ist.

• AI named
• New technology

Item 3

Systematic tracking (incl. online) plus one further criterion (GPS/WiFi tracking of passers-by, mobile-phone traffic analysis, wearables).

Systematisches Tracking (einschliesslich, aber nicht beschränkt auf Online-Anwendungen), wenn zusätzlich mindestens ein weiteres Kriterium der europäischen Leitlinien erfüllt ist.

• Large-scale monitoring

Item 4

Combining or matching data from different sources plus one further criterion (fraud/AML detection, direct marketing, loyalty, CRM, background checks for recruitment).

Kombination oder Abgleich personenbezogener Daten, die aus unterschiedlichen Quellen generiert werden und deren Verarbeitung, wenn zusätzlich mindestens ein weiteres Kriterium der europäischen Leitlinien erfüllt ist.

• Profiling or scoring

Annex III overlap: 4. Employment and workers’ management. Recruitment background checks correspond to Annex III point 4(a) (evaluating candidates) where an AI system is used; fraud detection is excluded from 5(b).

Item 5

Denial of services that are subject to a human decision but made with the additional help of automated decision-making (incl. profiling), plus one further criterion. Examples: refusal of a credit application after creditworthiness check; negative decisions on job applications; deciding whether to accept a customer again or change their conditions.

Verweigerung von Leistungen, die zwar einer menschlichen Entscheidung unterliegen, aber unter zusätzlicher Mithilfe von automatisierter Entscheidungsfindung (einschliesslich Profiling) erfolgen, wenn zusätzlich mindestens ein weiteres Kriterium der europäischen Leitlinien erfüllt ist.

• Automated decisions
• Profiling or scoring

Annex III overlap: 5. Essential private and public services · 4. Employment and workers’ management. Credit refusal (Annex III 5(b)) and negative recruitment decisions (Annex III 4(a)).

Item 6

Systematic workplace monitoring (e-mail and internet use, call recording, badge location tracking, GPS in company vehicles, movement profiles via RFID or phone tracking).

Systematische Überwachung am Arbeitsplatz

• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) where an AI system is used.

Item 8

Biometric data for unique identification plus one further criterion (facial recognition to monitor people in retail, face or fingerprint unlock, facial recognition in social media, fingerprint access control, school canteen fingerprint payment).

Verarbeitung von biometrischen Daten im Sinne von Art. 4 Ziff. 14 DSGVO zur eindeutigen Identifizierung natürlicher Personen, wenn zusätzlich mindestens ein Kriterium der europäischen Leitlinien erfüllt ist.

• Biometrics

Annex III overlap: 1. Biometrics. Retail facial-recognition monitoring corresponds to Annex III point 1(a); unlock/access examples are verification uses excluded from 1(a).

Item 11

Data of children or other vulnerable persons (even if not large scale) for marketing, profiling for automated decisions or online services.

Verarbeitung personenbezogener Daten von Kindern oder anderen schutzbedürftigen Personen ... für Marketing, Profiling für automatische Entscheidungsfindung oder für Angebote von Online-Diensten.

• Children
• Vulnerable people
• Profiling or scoring
• Automated decisions

Item 4

Biometric data for unique identification used for monitoring or control, or concerning vulnerable data subjects.

Biometrinių duomenų, kuriais siekiama konkrečiai nustatyti fizinio asmens tapatybę, tvarkymas duomenų subjektų stebėsenos ar kontrolės tikslais arba kai tvarkomi pažeidžiamų duomenų subjektų asmens duomenys.

• Biometrics
• Large-scale monitoring
• Vulnerable people

Annex III overlap: 1. Biometrics. Annex III point 1(a) where an AI remote biometric identification system is used.

Item 5

Genetic data used for evaluating or scoring characteristics, incl. profiling and forecasting.

Genetinių duomenų tvarkymas vykdant duomenų subjekto savybių vertinimą arba balų skyrimą, įskaitant profiliavimą ir prognozavimą.

• Profiling or scoring
• Health data

Item 6

Video surveillance in premises not controlled by the controller, in health, social care, detention or other institutions serving vulnerable persons, or combined with sound recording.

Asmens vaizdo duomenų tvarkymas, kai vaizdo stebėjimas vykdomas bent vienu iš žemiau nurodytų atvejų...

• Large-scale monitoring
• Vulnerable people

Item 8

Innovative technologies, or existing technologies used in a new way, when data of vulnerable data subjects are processed.

Asmens duomenų tvarkymas naudojant inovatyvias technologijas arba egzistuojančias technologijas panaudojant nauju būdu, kai tvarkomi pažeidžiamų duomenų subjektų asmens duomenys.

• New technology
• Vulnerable people

Item 9

Children's data for direct marketing, automated evaluation of children's personal aspects incl. profiling, or information-society services offered directly to children.

Vaikų asmens duomenų tvarkymas tiesioginės rinkodaros tikslais, vaikų asmeninių aspektų vertinimas, kuris yra grindžiamas automatizuotu tvarkymu, įskaitant profiliavimą, arba kai vaikams tiesiogiai yra siūlomos informacinės visuomenės paslaugos.

• Children
• Profiling or scoring
• Automated decisions

Item 10

Employees' data for monitoring or control: video and/or audio at the workplace; monitoring of employees' communication, behaviour, location or movement.

Darbuotojų asmens duomenų tvarkymas stebėsenos ar kontrolės tikslais...

• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) where an AI system is used.

Item 2

Processing of biometric data for identification of data subjects, combined with at least one other EDPB/WP248 criterion.

Les opérations de traitement qui incluent des données biométriques telles que définies à l'article 4 (14) du RGPD aux fins d'identification des personnes concernées en combinaison avec au moins un autre critère des lignes directrices du CEPD

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) where an AI remote biometric identification system is used.

Item 3

Combining, matching or comparing data collected for different purposes, provided this produces legal or similarly significant effects.

Les opérations de traitement impliquant la combinaison, la correspondance ou la comparaison de données à caractère personnel collectées à partir d'opérations de traitement ayant des finalités différentes ... à condition qu'elles produisent des effets juridiques...

• Automated decisions
• Profiling or scoring

Item 4

Regular and systematic monitoring of employee activities where it may produce legal or similarly significant effects on employees.

Les opérations de traitement qui consistent en ou qui comprennent un contrôle régulier et systématique des activités des employés - à condition qu'elles puissent produire des effets juridiques à l'égard des employés ou les affecter de manière aussi significative

• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Annex III point 4(b) where an AI system is used.

Item 7

Systematic tracking of natural persons' location.

Les opérations de traitement qui consistent en un suivi systématique de la localisation de personnes physiques

• Large-scale monitoring

Item 1

Evaluation or assessment, incl. profiling and prediction (behavioural analysis), with negative legal, physical, financial or other effects. Example: 'Ocena zdolności kredytowej, przy użyciu algorytmów sztucznej inteligencji' (creditworthiness assessment using artificial intelligence algorithms covered by secrecy); insurers pricing premiums from lifestyle, diet or driving.

Ewaluacja lub ocena, w tym profilowanie i przewidywanie (analiza behawioralna) w celach wywołujących negatywne skutki prawne, fizyczne, finansowe lub inne niedogodności dla osób fizycznych

• AI named
• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Creditworthiness assessment with AI algorithms corresponds to Annex III point 5(b); lifestyle-based insurance pricing overlaps 5(c) only for life and health insurance.

Item 2

Automated decision-making with legal, financial or similarly significant effects. Examples: traffic monitoring with automated vehicle identification, automated toll collection, automated promotional pricing from customer profiles.

Zautomatyzowane podejmowanie decyzji wywołujących skutki prawne, finansowe lub podobne istotne skutki

• Automated decisions

Item 3

Large-scale systematic monitoring of public places using recognition of features of objects (excluding CCTV recorded only for incident analysis). Areas include workplaces (monitoring e-mail, software use, access cards), IoT wearables, vehicle M2M, RFID.

Systematyczne monitorowanie na dużą skalę miejsc dostępnych publicznie wykorzystujące elementy rozpoznawania cech lub właściwości obiektów...

• Large-scale monitoring
• Employee monitoring
• New technology

Annex III overlap: 4. Employment and workers’ management. Workplace monitoring examples correspond to Annex III point 4(b) where an AI system is used.

Item 5

Biometric data solely for identifying a person or for access control. Areas: facial recognition systems, workplace identity verification, voice/fingerprint/face recognition in devices, banking.

Przetwarzanie danych biometrycznych wyłącznie w celu identyfikacji osoby fizycznej bądź w celu kontroli dostępu

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) covers remote biometric identification; access-control verification is excluded.

Item 8

Comparisons, evaluation or inference from analysis of data from various sources (e.g. marketing profiles, combining public registers).

Przeprowadzanie porównań, ocena lub wnioskowanie na podstawie analizy danych pozyskanych z różnych źródeł

• Profiling or scoring

Item 9

Data of persons whose evaluation and services depend on entities with supervisory or evaluating powers. Examples: job services adapting offers to employers' preferences, classifying persons by age or sex to present offers; whistleblowing systems.

Przetwarzanie danych dotyczących osób, których ocena i świadczone im usługi są uzależnione od podmiotów lub osób, które dysponują uprawnieniami nadzorczymi i/lub ocennymi

• Profiling or scoring
• Vulnerable people

Annex III overlap: 4. Employment and workers’ management. Job-offer targeting by classification corresponds to Annex III point 4(a) (placing targeted job advertisements) where an AI system is used.

Item 10

Innovative use of technological or organisational solutions. Examples: smart meters enabling profiling, IoT/wearables, devices with microphones and cameras, interactive toys for children, international telemedicine.

Innowacyjne wykorzystanie lub zastosowanie rozwiązań technologicznych lub organizacyjnych

• New technology
• Children
• Health data

Item 11

Processing that itself prevents exercising a right or using a service or contract. Examples: credit decisions from debtor databases; making service availability depend on income and profiling results.

Gdy przetwarzanie samo w sobie uniemożliwia osobom, których dane dotyczą, wykonywanie prawa lub korzystanie z usługi lub umowy

• Automated decisions
• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Credit decisions correspond to Annex III point 5(b).

Item 12

Processing of location data (IoT, home and remote working, employees' location data).

Przetwarzanie danych lokalizacyjnych

• Large-scale monitoring
• Employee monitoring

Item 1

Large-scale scoring, evaluation, prediction and profiling (e.g. creditworthiness from the central credit register; profiling drivers from driving data for personalised insurance).

Extensive evaluation and profiling of individuals

• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Creditworthiness example corresponds to Annex III point 5(b); motor insurance is outside 5(c).

Item 2

Automated decisions with legal or similar effects, e.g. on creditworthiness, social benefits entitlement, scholarship entitlement, job qualifications, health insurance entitlement.

Automated-decision making with legal or similar significant effect

• Automated decisions

Annex III overlap: 5. Essential private and public services. Creditworthiness (5(b)), social benefits (5(a)) and health insurance (5(c) covers risk assessment and pricing) examples; scholarship and job-qualification examples may touch points 3 and 4 but are not specific enough to assert.

Item 3

Systematic observation or surveillance people cannot avoid, e.g. automated number plate recognition, toll systems, e-government, passenger name record screening, offender blacklists, drone video surveillance, public-space CCTV, mass processing by law enforcement.

Systematic monitoring of individuals

• Large-scale monitoring

Annex III overlap: 6. Law enforcement. The example 'mass or systematic processing by law enforcement in connection with criminal and minor offences' is in the Annex III point 6 domain, which lists only specific AI uses.

Item 6

Matching or combining datasets and big data analytics (insurance claims trends, matching employee absenteeism with gender/age/education, shopping and movement habits, nation-wide registries).

Matching or combining of different datasets (e.g. obtained through different activities of data controllers) and big data analytics

• Profiling or scoring

Item 8

Innovative technologies with poorly understood consequences, e.g. intelligent video analytics systems, drones, some IoT such as smart metering.

Innovative use or applying new technological or organisational solutions

• New technology
• Large-scale monitoring

Item 9

Processing that allows, modifies or refuses access to a service or contract (nation-wide electronic toll collection; pre-screening against a credit reference database).

When the processing in itself prevents data subjects from exercising a right or using a service or a contract

• Automated decisions
• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Credit pre-screening corresponds to Annex III point 5(b).

Item 10

Fingerprints, faces or other biometric traits for unique identification, with at least one other criterion.

Processing of biometric data which is processed for the purpose of uniquely identifying a natural person in conjunction with at least one other criterion

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) where an AI remote biometric identification system is used.

Item Innovative technology

DPIA required for innovative use of technology combined with any other WP248 criterion. Examples: artificial intelligence, machine learning and deep learning; connected and autonomous vehicles; intelligent transport systems; smart technologies incl. wearables; market research involving neuro-measurement (emotional response analysis and brain activity); some IoT applications.

Innovative technologies: Processing involving the use of new technologies, or the novel application of existing technologies (including AI).

• AI named
• New technology

Item Denial of service

Decisions on access to a product, service, opportunity or benefit based to any extent on automated decision-making or profiling. Examples: credit checks, mortgage or insurance applications, other contract pre-checks (e.g. smartphones).

Denial of service: Decisions about an individual's access to a product, service, opportunity or benefit which are based to any extent on automated decision-making (including profiling) or involves the processing of special category data.

• Automated decisions
• Profiling or scoring

Annex III overlap: 5. Essential private and public services. Credit checks and insurance applications fall within Annex III point 5 (5(b) creditworthiness/credit score; 5(c) only life and health insurance). The ICO item is wider (any product, service, opportunity or benefit).

Item Large-scale profiling

Any profiling of individuals on a large scale. Examples: smart meter or IoT data, fitness/lifestyle monitoring, social media networks, 'Application of AI to existing process'.

Large-scale profiling: Any profiling of individuals on a large scale.

• AI named
• Profiling or scoring

Item Biometric data

Biometric processing for unique identification, combined with any other WP248 criterion. Examples: facial recognition systems, workplace access/identity verification, voice/fingerprint/facial recognition for access control.

Biometric data: Any processing of biometric data for the purpose of uniquely identifying an individual.

• Biometrics

Annex III overlap: 1. Biometrics. Annex III point 1(a) covers remote biometric identification and excludes verification-only systems; several ICO examples (access control, identity verification) are verification uses outside Annex III 1(a).

Item Tracking

Tracking of geolocation or behaviour, combined with any other WP248 criterion. Examples include online and cross-device tracking, eye tracking, data processing at the workplace, home and remote working, processing location data of employees.

Tracking: Processing which involves tracking an individual's geolocation or behaviour, including but not limited to the online environment.

• Large-scale monitoring
• Employee monitoring

Annex III overlap: 4. Employment and workers’ management. Workplace and employee-location examples correspond to Annex III point 4(b) (monitoring the performance and behaviour of persons in work relationships) only where an AI system is used.

Item Targeting of children/other vulnerable individuals

Use of children's or other vulnerable individuals' data for marketing, profiling or other automated decision-making, or offering online services directly to children. Examples: connected toys, social networks.

Targeting of children/other vulnerable individuals for marketing, profiling for auto decision making or the offer of online services

• Children
• Vulnerable people
• Profiling or scoring
• Automated decisions