Question

A privacy engineer completes a DPIA for a new AI-driven credit scoring platform that processes large volumes of financial data and produces automated decisions affecting individuals. After applying all feasible technical and organizational controls, the assessment shows that the residual risk to data subjects remains high. What should the privacy engineer recommend as the NEXT step before the processing begins?

Accepted Answer

Consult the relevant supervisory authority prior to commencing the processing

Answer

Document the residual risk in the risk register and accept it under the risk owner's authority

Answer

Proceed with the processing since all feasible controls have already been implemented

Answer

Obtain explicit consent from each affected data subject as the sole basis to proceed