Section 65 Prior consultation with the CommissionI1

This section applies where a controller intends to create a filing system and process personal data forming part of it.

The controller must consult the F1Commission prior to the processing if a data protection impact assessment prepared under section 64 indicates that the processing of the data would result in a high risk to the rights and freedoms of individuals (in the absence of measures to mitigate the risk).

Where the controller is required to consult the Commission under subsection (2), the controller must give the Commission—

Where the Commission is of the opinion that the intended processing referred to in subsection (1) would infringe any provision of this Part, the Commission must provide written advice to the controller and, where the controller is using a processor, to the processor.

The written advice must be provided before the end of the period of 6 weeks beginning with receipt of the request for consultation by the controller or the processor.

The F2Commission may extend the period of 6 weeks by a further period of 1 month, taking into account the complexity of the intended processing.

If the Commission extends the period of 6 weeks, the Commission must—