Regulation (EU) 2016/679 … (General Data Protection Regulation)¶
European Parliament & Council of the European Union. (2016). Regulation (EU) 2016/679 … (General Data Protection Regulation): Data Protection Impact Assessment. Official Journal of the European Union.
Cited by¶
14 citations across 14 artifacts.
Each citation links to the sentence it supports in the citing article.
Mechanisms¶
- API Response Projection
- The discipline is to project at the source, allow-list by default, and treat any new field as hidden until a view opts it in, honoring data minimisation
This sourceRequires data protection by default so that only personal data necessary for each purpose are processed and accessible.
- The discipline is to project at the source, allow-list by default, and treat any new field as hidden until a view opts it in, honoring data minimisation
- Backlog Report
- Its redaction layer also lets sensitive backlogs be discussed at all, following the principle of data minimization: show each audience the least detail sufficient for its decision.
This sourceDefines data minimization as limiting personal data to what is adequate, relevant, and necessary for the stated purpose.
- Its redaction layer also lets sensitive backlogs be discussed at all, following the principle of data minimization: show each audience the least detail sufficient for its decision.
- Blanket Variable Quality Audit
- First, the pipeline ingests fine-grained transaction geolocation that adds nothing to the screened estimate — a variable collected because it was available, not because it is necessary; it is flagged under data-minimization for removal.
This sourceRequires personal-data collection to be limited to what is necessary for the stated processing purpose.
- First, the pipeline ingests fine-grained transaction geolocation that adds nothing to the screened estimate — a variable collected because it was available, not because it is necessary; it is flagged under data-minimization for removal.
- Controlled Exception Register
- First, it can quietly become a surveillance asset — a store built to track legitimate departures gets repurposed for profiling or unrelated enforcement, which is exactly why data-minimization discipline belongs in the schema, not bolted on later.
This sourceRequires purpose limitation and data minimization to be built into the design and operation of personal-data processing.
- First, it can quietly become a surveillance asset — a store built to track legitimate departures gets repurposed for profiling or unrelated enforcement, which is exactly why data-minimization discipline belongs in the schema, not bolted on later.
- Data Portability Rule
- The customer's accumulated financial history follows them, and the switch turns on which bank is better rather than on who is holding the ledger, in the spirit of the data-portability right in modern privacy law.
This sourceEstablishes a legal right to receive qualifying personal data in a machine-readable format and transmit it to another controller.
- The customer's accumulated financial history follows them, and the switch turns on which bank is better rather than on who is holding the ledger, in the spirit of the data-portability right in modern privacy law.
- Exit and Interoperability Rule
- Data-portability rights in law show the same trap — a right to move one's data means little without the tooling and formats to actually move it
This sourceGrants a right to receive and transmit personal data in structured, commonly used, machine-readable and interoperable formats, including direct controller-to-controller transfer where feasible.
- Data-portability rights in law show the same trap — a right to move one's data means little without the tooling and formats to actually move it
- Human Review Trigger
- It is the operational form of meaningful human review of automated decisions — a principle codified where laws grant individuals a right not to be subject to solely automated decisions with significant effects.
This sourceCodifies a right against solely automated decisions with legal or similarly significant effects and requires safeguards that include obtaining human intervention.
- It is the operational form of meaningful human review of automated decisions — a principle codified where laws grant individuals a right not to be subject to solely automated decisions with significant effects.
- Portability or Interoperability Commitment
- The honest reference point is the right to data portability codified in regulation such as the GDPR, which treats machine-readable, re-usable export as the test, not the existence of a download link.
This sourceCodifies a right to data portability through structured, commonly used, machine-readable export and transfer.
- The honest reference point is the right to data portability codified in regulation such as the GDPR, which treats machine-readable, re-usable export as the test, not the existence of a download link.
- Privacy Impact Review
- This is the "assess before you share" logic of a formal data-protection impact assessment.
This sourceRequires a data-protection impact assessment before envisaged processing likely to create high risk, including covered disclosure operations.
- This is the "assess before you share" logic of a formal data-protection impact assessment.
- Purpose-Bound Security Condition Record
- The disciplines that guard against both are genuine purpose limitation — the collected data and the condition are used only for the purpose recorded, never repurposed by default
This sourceRequires personal data to be collected for specified purposes and not further processed incompatibly with them.
- The disciplines that guard against both are genuine purpose limitation — the collected data and the condition are used only for the purpose recorded, never repurposed by default
- Remediation Sweep
- The governing principle in the data case above — data minimization, collecting and keeping only what is needed — is what stops the reservoir from simply refilling after the purge.
This sourceCodifies data minimization by requiring personal data to be adequate, relevant, and limited to what is necessary for the stated purpose.
- The governing principle in the data case above — data minimization, collecting and keeping only what is needed — is what stops the reservoir from simply refilling after the purge.
- Reputation Portability Protocol
- The general principle is echoed in law, such as the data-portability right in regimes like the GDPR.
This sourceEstablishes a legal right to receive and transmit qualifying personal data in a structured, commonly used, machine-readable format.
- The general principle is echoed in law, such as the data-portability right in regimes like the GDPR.
- Role-Specific Policy Table
- Assigning distinct duties to distinct roles — and pairing power with accountability — is the backbone of most controller/processor and fiduciary regimes.
This sourceAssigns different legal duties to controllers and processors and makes controllers responsible for demonstrating compliance.
- Assigning distinct duties to distinct roles — and pairing power with accountability — is the backbone of most controller/processor and fiduciary regimes.
- Structured Workaround Registry
- The design guard against the second is data minimization
This sourceRequires personal data to be limited to what is necessary and kept no longer than needed for its stated purpose.
- The design guard against the second is data minimization
Verification¶
Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.
Does it back the claim? Not recorded. Neither this nor any other of the 14 citations of this work carries a recorded support check.
Was it audited? Yes. A second, independent pass read the citation against the article text and recorded a verdict.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 2 other ways.
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 ×4
- https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32016R0679 ×1
Registry ID ref:5542a2143b3e · see in the full table