AIPD : combining advanced legal expertise with an effective solution

On July 1, Adequacy — through the voice of its CMO Stéphane Galois — participated in a webinar organized by the law firm Klein Wenner, dedicated to AIPD.

Alongside Matthieu Bourgeois and Laurent Badiane, partner lawyers in charge of the Immaterial & Digital practice and team of Klein Wenner, Sophie de Kermenguy, lawyer within this team, the opportunity to take stock of impact analyses, and to share the feedback ofAurélie Banck, DPO ofEuropcar Mobility Group.

It is also an opportunity to look back on the partnership established several months ago between Adequacy and Klein Wenner, which made it possible to offer Adequacy users an even more effective and accessible AIPD module.

A look back at the strengths of this webinar.

AIPDs, the culmination of a certain vision of Europe with regard to technologies

Europe was marked by two traumas linked to the use of technologies put at the service of ideological projects, first time in 1904, as part of the Dreyfus Affair, which gave rise to the “file case” in the army and then, later, the generalized registration of populations during the Second World War.

These two traumas gave the old continent a certain maturity, and also a cautious approach to technologies, which we understood could have harmful effects if we did not measure their impact from the beginning.

In short, digital technology deserves to be thought out and its contributions balanced, in particular by examining the risks it poses for the people it will affect.

By establishing the concept of impact assessment, the RGPD is part of this logic.

AIPD, a complex approach that organizations have not yet grasped

While, according to the texts, 2021 should be the year of impact assessments, the data show that the implementation of AIPDs is few at the level of France and Europe.

The feedback from Adequacy users shows us that only 30% of them got down to it, and only 10% of them went all the way. Despite the May 25, 2021 deadline, organizations have not yet taken up the subject head-on, a subject that seems complex to them and for which they feel a strong need for pragmatism.

This perceived complexity cannot be denied: because an AIPD is at the confluence of different professions, because, to be carried out correctly, it requires a construction in 4 steps and an excellent understanding of the context of the organization concerned, because an impact assessment represents both an accountability and risk management tool, it requires a lot of work and cannot be done hastily, between two meetings.

It is a fundamental work, for which many organizations feel the need to be supported.

The AIPD path therefore promises to be a long one.

Adequacy/Klein Wenner collaboration: a common vision to promote the implementation of a structuring approach

For almost two years, the Adequacy solution had an AIPD module. With a view to May 25, 2021, we wanted to develop this module, based on these two years of use, proven practice and feedback.

When we met the law firm Klein Wenner, we were immediately marked by a shared conviction: beyond our shared vision of data and associated challenges, we are convinced that the implementation of AIPDs will represent a paradigm shift. With impact assessments, organizations will move to an approach Ex Ante, anticipating damage rather than seeking to repair it. Above all, they will move from a vision of risks centered on the company to a vision of risks. client-centric.

We believe that impact analyses have the power of profound transformation and that they will become a powerful tool for change management and the continuous improvement of organizations.

So how can we, at our level, be able to help organizations to move forward on this path, to take up the subject?

• By combining the specialized legal expertise of a team of experienced lawyers in data law with the technological solidity of our solution
• By not doing for customers, but with them, thanks to a step-by-step and supported approach
• By anchoring our AIPD module in an educational and accessible approach, thanks to the implementation of input assistants, the pre-intelligence of threat scenarios and the provision of quality renderings

In the key: Adequacy version 5.0 which offers in particular a redesigned registry and AIPD module

• We worked with Klein Wenner to conceptualize a solution that is both structuring and pragmatic, which values the productions of the Klein Wenner team and provides the elements necessary to carry out an AIPD.
• We have found a subtle compromise with selected words that are important: speaking Juridico/DPO/Technical is an art in constant evolution!
• Although we have simplified and automated processes, there is obviously still the strength and the richness of human analysis: the tool, our solution, does not solve anything, it is at the service of the company.
• Our solution is improving every day thanks to you and thanks to the Klein Wenner teams and our ability to automate processes.

Reminder: the 4 stages of an AIPD

1 — systematic description of the processing operations envisaged and the purposes of the processing

2 — assessment of the necessity and proportionality of processing operations in relation to the purposes

3 — Risk assessment for the rights and freedoms of the persons concerned

4 — measures envisaged to deal with risks, including security guarantees, measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with the GDPR.