DPIA needed in those 17 situations related to data manipulation and affecting legal rights