Extract to table

It is subject to legal professional privilege and must not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and the General Counsel of Northgate Telecommunications PLC

Article 35(1) provides that where a type of processing, in particular using new technologies, and taking into account the nature, scope, context, and purposes of the processing, is "likely to result in a high risk to the rights and freedoms of natural persons", the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data

Article 36 GDPR / UK GDPR requires that where a DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller cannot sufficiently mitigate the residual risk, the controller must consult the relevant supervisory authority prior to the processing

Ongoing monitoring is required to ensure that the mitigation measures are effective in practice

An Article 9 condition must also be met, and as set out above, no viable Article 9 condition was identified