Prior consultation

66.(1) The data controller shall consult the Commissioner prior to processing where a data protection impact assessment under section 65 indicates that the processing would result in a high risk to the rights and freedoms of an individual in the absence of measures taken by the data controller to mitigate the risk.

(2) Where the Commissioner is of the opinion that the intended processing referred to in subsection (1) would infringe this Act, in particular where the data controller has insufficiently identified or mitigated the risk, the Commissioner shall, within a period of up to 8 weeks of receipt of the request for consultation, provide written advice to the data controller and, where applicable to the data processor.

(3) The period mentioned in subsection (2) may be extended by 6 weeks, taking into account the complexity of the intended processing.

(4) The Commissioner shall inform the data controller and, where applicable, the data processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay.

(5) The period mentioned in subsection (2) may be suspended until the Commissioner has obtained information he has requested for the purposes of the consultation.

(6) When consulting the Commissioner pursuant to subsection (1), the data controller shall provide the Commissioner with:

(a) where applicable, the respective responsibilities of the data controller and data processors involved in the processing, in particular for processing within a group of undertakings;

(b) the purposes and means of the intended processing;

(c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Act;

(d) where applicable, the contact details of the data privacy officer;

(e) the data protection impact assessment provided for in section 65;

(f) any other information requested by the Commissioner.