Fairness and Data Protection Impact Assessments

TL;DR

This paper critically examines the effectiveness of GDPR's DPIA requirement, highlighting the limited practical emphasis on fairness principles despite their theoretical importance in data protection assessments.

Contribution

It reveals a disconnect between the theoretical role of fairness in DPIAs and its practical application in guidance documents issued by authorities.

Findings

Fairness is theoretically central to DPIAs.

Guidance documents rarely mention fairness in practice.

There is a gap between theory and practice in DPIA assessments.

Abstract

In this paper, we critically examine the effectiveness of the requirement to conduct a Data Protection Impact Assessment (DPIA) in Article 35 of the General Data Protection Regulation (GDPR) in light of fairness metrics. Through this analysis, we explore the role of the fairness principle as introduced in Article 5(1)(a) and its multifaceted interpretation in the obligation to conduct a DPIA. Our paper argues that although there is a significant theoretical role for the considerations of fairness in the DPIA process, an analysis of the various guidance documents issued by data protection authorities on the obligation to conduct a DPIA reveals that they rarely mention the fairness principle in practice.