NIST Privacy Framework, Identify-PID.RA-P5

Adopt a set of measures against the risks processing poses to a personal data subject's rights and freedoms before relying on any Article 8 exception to process special personal data.

If you offer an online service, product, or feature that you actually know or willfully disregard is used by a minor, use reasonable care to avoid a heightened risk of harm to that minor, and complete a data protection assessment where that risk exists.

Apply specific safeguards to any marketing or profiling directed at children, and put anything addressed to a child in clear, plain language they can easily understand.

Document and justify internally any exclusion of the data protection officer, impact assessment, anonymization, audit or code of conduct measures, and keep the documentation available to the Commission nationale pour la protection des données (Article 181-3, paragraph 2).

Where an exception permits sensitive data to be processed, put in place the safeguards the law or the CMIL requires for that exception.

Put safeguards in place to prevent discrimination or another risk to a person's rights and freedoms wherever an exception lets you process their sensitive data on a public interest, medical, or archival, research, or statistical ground.

Where you rely on the vital-interests or right-or-obligation grounds to process sensitive personal data without consent, put appropriate safeguards in place first.

Take particular care when you do process the data listed above, so it does not cause unfair discrimination, prejudice, or other harm to the data subject.

Where you cannot be certain an artificial intelligence system's processing will not cause serious, irreversible harm, refrain from that processing or adopt precautionary measures, and adapt your risk management systems to identify, measure, control and monitor the situations that could affect your compliance with personal data protection rules.

Before introducing camera surveillance, examine less intrusive means, keep the intrusion on employee privacy to what is necessary, use recordings only for the purposes of the surveillance, inform employees after the cooperation or consultation procedure, and announce the surveillance visibly in the premises where cameras are placed (Section 17, paragraph 1).

Analyse the goal of a video surveillance system before installing it, and reassess it every two years, covering the continuing need for it, its goals, and feasible technical alternatives.

Take reasonable steps to prevent reasonably foreseeable physical or financial harm to children, severe and reasonably foreseeable psychological or emotional harm to a reasonable child, a highly offensive intrusion on privacy rights, and adverse discrimination in violation of state or federal law.

Run a data protection impact assessment and document why a less intrusive alternative was rejected before deploying a biometric access-control system for employees or building access in France.

The data importer notifies the data exporter promptly if it has reason to believe that it is or has become subject to laws or practices not in line with Clause 14(a); the data exporter then promptly identifies appropriate measures and suspends the transfer if it considers that no appropriate safeguards can be ensured, or if instructed to do so by the competent supervisory authority (Clause 14(e) and (f)).

Where the oversight or evaluation identifies a high risk of discrimination at work in the use of your automated monitoring systems or automated decision-making systems, or finds that individual decisions have infringed the rights of a person performing platform work, take the steps necessary, including, if appropriate, the modification of the system or the discontinuation of its use, in order to avoid such decisions in the future (Article 10(3)).