NIST Privacy Framework, Identify-PID.RA-P3

If you are the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary or the prison administration processing personal data under Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions or the execution of sentences, study the impact of a type of processing likely to create a high risk to a person's rights and freedoms before carrying it out.

Offer consumers a way to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects, and complete a data protection assessment before processing that presents a heightened risk of harm.

Conduct a Data Protection Impact Assessment for high risk processing under the Databeskyttelsesloven and GDPR Article 35.

Establish and implement governance policies and practices for personal information, including a framework for retention and destruction, and conduct a privacy impact assessment before acquiring, developing or overhauling a system or service that collects, uses, communicates, keeps or destroys personal information.

Run a documented impact assessment weighing public interest against individual privacy, and register the surveillance, before operating a camera or optical-electronic monitoring system in Sweden, whether or not it performs facial recognition.

Assess foreseeable privacy harms before deploying a system that collects or uses biometric identifiers derived from photographs, videos, or voice recordings, and disclose material facts about that collection.