
[Artikel 6 Rechtmatigheid van de verwerking](../AVG-OST/AVG2018-Art-6.md) / 
[Art. 6 Lawfulness of processing](https://gdpr-text.com/read/article-6/#0), 4b: "the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;" should be taken into account 


[Art. 35 GDPR. Data protection impact assessment](https://gdpr-text.com/read/article-35/#para_gdpr-a-35_3b)

[Guidelines on Data Protection Impact Assessment (DPIA) (wp248rev.01)](https://ec.europa.eu/newsroom/article29/items/611236):
- From [Recital 75](https://gdpr-info.eu/recitals/no-75/): 
	- "The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects."
- Criterium 7 for processing "likely to result in a high risk" (p10):
	- increased power imbalance between the data subjects and the data controller
	- Vulnerable data subjects may include children (...), employees, more vulnerable segments of the population requiring special protection (mentally ill persons, asylum seekers, or the elderly, patients, etc.), and in any case where an imbalance in the relationship between the position of the data subject and the controller can be identified.


Examples of controller-subject relationships:
- employee; contractor; supplier; member of employee’s household; member of public; children or other vulnerable groups
- ●      Employees, contractors, and temporary workers (current, former, prospective) of data exporter;

●      Dependents of the above;

●      Data exporter's collaborators/contact persons (natural persons) or employees, contractors, or temporary workers of legal entity collaborators/contact persons (current, prospective, former);

●      Users (e.g., customers, clients, patients, visitors, etc.) and other data subjects that are users of data exporter's services;

●      Partners, stakeholders, or individuals who actively collaborate, communicate or otherwise interact with employees of the data exporter and/or use communication tools such as apps and websites provided by the data exporter;

●      Stakeholders or individuals who passively interact with data exporter (e.g., because they are the subject of an investigation, research or mentioned in documents or correspondence from or to the data exporter);

●      Minors; or

●      Professionals with professional privilege (e.g., doctors, lawyers, notaries, religious workers, etc.).




**_You may wish to consider particularly whether the processing could possibly result in risks relating to:_**

·       **_Inability of individuals to exercise their GDPR rights_**

·       **_Inability to access services or opportunities_**

·       **_Loss of control over personal data_**

·       **_Discrimination_**

·       **_Identity theft or fraud_**

·       **_Financial loss_**

·       **_Reputational damage_**

·       **_Physical harm_**

·       **_Loss of confidentiality_**

·       **_Any other significant economic or social disadvantage_**

·       **_Requests not to receive marketing are not observed_**

·       **_Tracking without the individual’s knowledge or consent_**

·       **_Special characteristics are gathered in a non-compliant way_**

·       **_The individual’s data is used in ways they had not been told about or would reasonably expect_**

·       **_The individual’s data has been shared with other organizations without their knowledge_**

·       **_The individual’s data has been retained for far longer than they would have anticipated_**

·       **_Data has not been kept secure_**

·       **_More data than is strictly necessary has been gathered_**