Article 36. Prior consultation
(1) The controller shall consult the Centre prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.
(2) Where the Centre considers that the intended processing referred to in paragraph (1) would infringe this Law, in particular where the controller has not identified the risk or has not mitigated it to a sufficient extent, the Centre shall, no later than eight weeks after receipt of the request for consultation, provide written advice to the controller and, where applicable, to the processor, and may use any of its powers referred to in art. 60. That period may be extended by six weeks, taking into account the complexity of the intended processing. The Centre shall inform the controller and, where applicable, the processor of any such extension within one month of receipt of the request, stating the reasons for the delay. Those periods may be suspended until the Centre has obtained the information it has requested for the purposes of the consultation.
(3) When consulting the Centre pursuant to paragraph (1), the controller shall provide the Centre with:
- a) where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing activities, in particular for processing within a group of enterprises;
- b) the purposes and means of the intended processing;
- c) the measures and safeguards provided for to protect the rights and freedoms of data subjects pursuant to this Law;
- d) where applicable, the contact details of the data protection officer;
- e) the data protection impact assessment; and
- f) any other information requested by the Centre.
(4) Draft normative acts containing provisions on the processing of personal data shall be submitted to the Centre for an opinion under the conditions of Law No. 100/2017 on Normative Acts.