Status: screened, no DPIA required at current scope
GDPR Art 35(1) requires a Data Protection Impact Assessment where processing is "likely to result in a high risk" to data subjects. This document records the screening, the reasoning, and — importantly — the design choices that were made in order to stay below the threshold. It is not a DPIA; it is the evidence that one is not currently owed.
Scope: the two web-analytics lanes only. MCP usage telemetry (mcp.call_log, see
architecture/hosted-mcp.md) is a separate subsystem this
screening does not cover. Its private lane (surface='private', full question/answer capture)
records only the operator's own bearer-authenticated calls — first-party data with no data
subject other than the operator, so it does not change this screening's scope.
Art 35(3) — the mandatory triggers
| Trigger | Applies? | Reasoning |
|---|---|---|
| (a) Systematic and extensive evaluation of personal aspects, based on automated processing, on which decisions producing legal or similarly significant effects are based | No | No decision of any kind is made about an individual. Output is aggregate. Art 22 is a hard boundary in both lanes. |
| (b) Large-scale processing of special categories (Art 9) or criminal-offence data | No | No special-category data is sought or collected. Form-field content — the plausible accidental route to Art 9 data — is never read; only which field was abandoned. |
| (c) Systematic monitoring of a publicly accessible area on a large scale | No | "Publicly accessible area" in Art 35(3)(c) means physical space (CCTV and equivalents), not a website. |
None of the three mandatory triggers fires.
WP248 rev.01 — the nine criteria
The Art 29 WP guidance (endorsed by the EDPB) treats two or more criteria as a strong indicator that a DPIA is needed.
| # | Criterion | Met? | Reasoning |
|---|---|---|---|
| 1 | Evaluation or scoring | No | Nothing is scored, ranked, or predicted. |
| 2 | Automated decision-making with legal/significant effect | No | No decisions. Art 22 boundary is explicit and enforced. |
| 3 | Systematic monitoring | Partly | Behaviour on our own site is observed systematically. Mitigated: the identifier is keyed rather than a bare digest, so it cannot be reversed to (IP, UA) from a database copy; it carries no cross-site or third-party key, so nothing accumulates beyond this one site; every row is deleted at 60 days; and observation stops entirely on objection. Note the identifier does NOT rotate daily — see the necessity analysis in legitimate-interest.md. |
| 4 | Sensitive data / highly personal data | No | None collected. |
| 5 | Data processed on a large scale | No | A single small site. Not large scale on WP248's volume, geography, duration, or subject-count factors. |
| 6 | Matching or combining datasets | No | This is what the two-lane wall prevents. The anonymous and authenticated lanes share no key and cannot be joined. |
| 7 | Data concerning vulnerable subjects | No | No children's data sought; no employee/patient relationship. |
| 8 | Innovative use or new technology | No | Conventional first-party server-side analytics. |
| 9 | Processing preventing rights/contract access | No | Nothing is gated on it. |
Score: one partial. Below the two-criteria indicator, and the single partial is itself mitigated by daily rotation and a working objection route.
What would have crossed the threshold
Recorded deliberately, because the screening only holds while these stay out of scope:
- Session replay / DOM recording. Would immediately engage criteria 3 and 4 (recordings routinely capture incidental sensitive data), and plausibly 1. Rejected — see the necessity analysis in legitimate-interest.md. Note the CNIL recommendation on this is still in draft as of this writing; its direction (mandatory masking, minimisation, purpose limitation, DPIA likely) is a reliable signal even though the final text is not fixed.
- Joining the two lanes. Criterion 6, directly. It would also convert criterion 3 from partial to full, since a stable identity plus behavioural history is a profile.
- Adding entropy to the visitor hash. Moves the technique into confirmed fingerprinting territory under EDPB Guidelines 2/2023, strengthening criterion 3 and adding an ePrivacy consent obligation on top.
- Form-field content capture. Criterion 4, via incidental Art 9 data.
- Any personalisation or scoring derived from either lane. Criteria 1 and 2, and Art 22.
Re-screening triggers
Re-run this screening before adding any item from the list above, before any material change in traffic scale, and whenever legitimate-interest.md is re-run — the two documents share their factual basis and should not drift apart.
Related
- legitimate-interest.md — Art 6(1)(f) assessment
- two-lane-model.md — the separation this screening depends on