Question

A privacy engineer is conducting a DPIA for a new employee wellness platform that will collect health-related biometric data through wearable devices. The DPIA has documented the processing operations, assessed necessity and proportionality, and identified several high risks to employees. Before finalizing the assessment and treatment plan, which action best strengthens the DPIA in accordance with recognized privacy risk management practice?

Accepted Answer

Seek the views of the affected employees or their representatives on the intended processing, where appropriate

Answer

Submit the DPIA directly to the supervisory authority for prior approval before any consultation

Answer

Have the CISO sign off on the encryption controls so the DPIA can be closed

Answer

Delay the DPIA until the platform is deployed so that real usage data can inform the risk ratings