Extract to table

This document must not be disclosed to third parties without the prior written consent of Calderwood & Harkness LLP and NTP

1 Purpose of this DPIA Article 35(1) of the GDPR, as retained and supplemented by the Data Protection Act 2018 ("DPA 2018") (together, the "UK GDPR"), provides that where a type of processing, in particular using new technologies and taking into account the nature, scope, context, and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data

Each DPIA must be assessed on its own facts, and the materially different context of the present Pilot leads to a fundamentally different risk assessment and conclusion

For the processing of biometric data (facial recognition templates), which constitutes special category data, NTP must satisfy one of the conditions set out in Article 9(2) of the GDPR in addition to the Article 6 lawful basis

However, this condition requires that the processing must be necessary for the purposes of the prevention or detection of an unlawful act and must be carried out without the consent of the data subject "so as not to prejudice those purposes

This database is a permanent repository of special category data that must be maintained and updated on an ongoing basis for the facial recognition system to function