A national supervisory authority is preparing to adopt a list of processing operations that require a data protection impact assessment in its territory. Before the list takes effect, the authority is required to engage a Union-level mechanism. Which body must it involve, and for what purpose?
- AThe European Commission, which must approve the list as an implementing measure before it can be applied nationally.
- BThe European Data Protection Board, which issues an opinion under the consistency mechanism to promote a harmonised approach across authorities. Correct
- CThe European Data Protection Supervisor, which reviews the list because DPIA obligations originate in the rules governing EU institutions.
- DThe Court of Justice of the European Union, which validates the list to ensure it complies with the Charter of Fundamental Rights.
Why A is wrong: Tempting because the Commission adopts implementing acts elsewhere in the GDPR, but DPIA lists are communicated to the EDPB for consistency, not submitted to the Commission for approval.
Why B is correct: Correct: lists of processing requiring a DPIA are subject to the consistency mechanism, so the authority communicates the list to the EDPB, which gives an opinion to keep such lists consistent across the Union.
Why C is wrong: Tempting because the EDPS works on data protection at Union level, but it supervises EU institutions and does not review national authorities' DPIA lists, which fall under the EDPB's consistency role.
Why D is wrong: Tempting because the Charter underpins data protection, but the CJEU does not pre-clear administrative lists; consistency review of DPIA lists is an EDPB function under the cooperation framework.