| name | pia-large-scale-monitor |
| title | Privacy Impact Assessment for Large-Scale Monitoring |
| description | Conducts Privacy Impact Assessment for large-scale systematic monitoring under GDPR Article 35(3)(c). Covers CCTV and video surveillance, employee monitoring, location tracking, internet monitoring, and behavioural analytics. Applies EDPB WP248rev.01 criteria for systematic monitoring of publicly accessible areas. Keywords: DPIA, large-scale monitoring, CCTV, employee monitoring, systematic monitoring, surveillance, location tracking. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/plugins/privacy-skills-complete/skills/pia-large-scale-monitor |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Privacy Impact Assessment for Large-Scale Monitoring
Overview
GDPR Article 35(3)(c) mandates a DPIA for systematic monitoring of a publicly accessible area on a large scale. The EDPB in WP248rev.01 identifies systematic monitoring as criterion C3, which often combines with other criteria (large scale C4, vulnerable data subjects C7, innovative technology C8) to trigger mandatory DPIA. This skill covers PIA methodology for CCTV/video surveillance, employee monitoring, location tracking, internet/communications monitoring, and behavioural analytics systems.
Regulatory Framework
GDPR Requirements
| Provision | Relevance to Large-Scale Monitoring |
|---|
| Art. 35(3)(c) | Mandatory DPIA for systematic monitoring of publicly accessible area on a large scale |
| Art. 35(1) | DPIA required when processing is likely to result in a high risk to rights and freedoms |
| Art. 6(1)(f) | Legitimate interests as typical lawful basis for monitoring; requires balancing test |
| Art. 5(1)(c) | Data minimisation: collect only what is necessary for the monitoring purpose |
| Art. 5(1)(e) | Storage limitation: retain monitoring data only as long as necessary |
| Art. 12-14 | Transparency obligations: informing data subjects about monitoring |
| Art. 21 | Right to object to processing based on legitimate interests |
| Art. 22 | Automated decision-making restrictions applicable to behavioural analytics |
EDPB and National Authority Guidance
- EDPB Guidelines 3/2019 on Video Devices: Comprehensive guidance on CCTV use, including legal basis, transparency, retention, and access rights for video surveillance.
- EDPB WP248rev.01 Annex: National supervisory authority blacklists frequently include large-scale monitoring activities as mandatory DPIA triggers.
- ICO Employment Practices Code: UK guidance on workplace monitoring including CCTV, email, internet, and vehicle tracking.
- CNIL Guidance on Employee Monitoring (2023): French DPA requirements for workplace surveillance including keystroke logging, screen capture, and video monitoring.
Monitoring Scenarios
1. CCTV and Video Surveillance
Scope: Fixed and mobile cameras in public spaces, retail premises, transport hubs, workplaces.
Key risks: Mass surveillance of individuals in publicly accessible areas; facial recognition enabling biometric identification; disproportionate retention creating behavioural profiles; function creep from security to performance monitoring.
:
