Regulation (EU) 2016/794 of the European Parliament and of the CouncilShow full title

Article 39 Prior consultation

1. Any new type of processing operations to be carried out shall be subject to prior consultation where:

(a) special categories of data as referred to in Article 30(2) are to be processed;

(b) the type of processing, in particular using new technologies, mechanisms or procedures, presents specific risks for the fundamental rights and freedoms, and in particular the protection of personal data, of data subjects.

2. The prior consultation shall be carried out by the EDPS following receipt of a notification from the Data Protection Officer that shall contain at least a general description of the envisaged processing operations, an assessment of the risks to the rights and freedoms of data subjects, the measures envisaged to address those risks, safeguards and security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation, taking into account the rights and legitimate interests of the data subjects and other persons concerned.

3. The EDPS shall deliver his or her opinion to the Management Board within two months following receipt of the notification. That period may be suspended until the EDPS has obtained any further information that he or she may have requested.

If the opinion has not been delivered after four months it shall be deemed to be favourable.

If the opinion of the EDPS is that the notified processing may involve a breach of any provision of this Regulation, he or she shall, where appropriate, make proposals to avoid such a breach. Where Europol does not modify the processing operation accordingly, the EDPS may exercise the powers granted to him or her under Article 43(3).

4. The EDPS shall keep a register of all processing operations that have been notified to him or her pursuant to paragraph 1. The register shall not be made public.