Possible aspects of the periodic review of data protection impact assessment for data controlling with state-used unmanned aerial vehicles

Abstract

Since the end of the last century, the legal institution of the data protection impact assessment has been an integral part of the procedures related to the management of personal data and is an indispensable tool for the preliminary assessment and mitigation of risks. However, the processing of personal data takes place in a dynamic social and organizational environment, the passage of time not only affects the accuracy of the data, but can also bring about changes in the conditions of data processing. The risk-focused approach of the General Data Protection Regulation ‒ the GDPR ‒ requires data controllers to proactively keep up with such changes and, if necessary, revise their previous findings and assess the risks of their activities under changed conditions. This paper outlines a kind of framework for this, which can serve as a guideline for the data protection specialist areas in the review of the data protection impact assessment when state-used unmanned aerial vehicles are used as a means of data management.