section 22 (3). (3) The controller or processor shall, on request, make the record available to the Office. PART V – PROCESSING OPERATIONS LIKELY TO PRESENT RISK 34. Data protection impact assessment (1) Where processing operations are likely to result in a high risk to the rights and freedoms of data subjects by virtue of their nature, scope, context and purposes, every controller or processor shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. (2) The processing operations referred to in subsection (1) are – (a) a systematic and extensive evaluation of personal aspects relating to individuals which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the individual or significantly affect the individual; (b) processing on a large scale of special categories of data referred to in section 29; (c) a systematic monitoring of a publicly accessible area on a large scale;