Article 40Prior consultation

1. The controller shall consult the European Data Protection Supervisor prior to processing where a data protection impact assessment under Article 39 indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons and the controller is of the opinion that the risk cannot be mitigated by reasonable means in view of the available technologies and costs of implementation. The controller shall seek the advice of the data protection officer on the need for prior consultation.

2. Where the European Data Protection Supervisor is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the European Data Protection Supervisor shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of his or her powers referred to in Article 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The European Data Protection Supervisor shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. Those periods may be suspended until the European Data Protection Supervisor has obtained information it has requested for the purposes of the consultation.

3. When consulting the European Data Protection Supervisor pursuant to paragraph 1, the controller shall provide the European Data Protection Supervisor with:

(a)

where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing;

(b)

the purposes and means of the intended processing;

(c)

the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;

(d)

the contact details of the data protection officer;

(e)

the data protection impact assessment provided for in Article 39; and

(f)

The article continues in the official text.