In Which of the Following Cases, Cited as an Example

question 151

Multiple Choice

In which of the following cases, cited as an example by a WP29 guidance, would conducting a single data protection impact assessment to address multiple processing operations be allowed?

• A) A medical organization that wants to begin genetic testing to support earlier research for which they have performed a DPIA.
• B) A data controller who plans to use a new technology product that has already undergone a DPIA by the product's provider.
• C) A marketing team that wants to collect mailing addresses of customers for whom they already have email addresses.
• D) A railway operator who plans to evaluate the same video surveillance in all the train stations of his company.