Carrying out an impact assessment

Some uses of AI process personal data in a way that can seriously affect people: health data, staff data for an evaluation, large-scale processing. In these cases, the revised FADP, in Article 22, and the GDPR, in Article 35, require a data protection impact assessment before you start.

• The description of the processing: purpose, data, people concerned, retention period.
• The assessment of the risks to the personality and fundamental rights of the people concerned.
• The measures planned to reduce these risks.
• The conclusion: is the residual risk acceptable?

For the description, Learnya’s compliance file gives you many of the elements: data and models located in Switzerland, content not used for training, the data processing agreement, self-service export. The risks and the measures, however, depend on your use.

If the risk remains high despite the measures, Article 23 of the revised FADP requires consulting the Federal Data Protection and Information Commissioner (FDPIC) before you start. The GDPR likewise provides for consulting the supervisory authority. In most cases, better measures are enough to avoid this step.