Article 33b (prior consultation Autoriteit persoonsgegevens)

• 1

  The Autoriteit persoonsgegevens Authority shall be consulted by the controller or processor about the proposed processing of police data to be included in a new file when:

  • a.

    the nature of the processing, in particular using new technologies, mechanisms or procedures, poses a high risk to the rights and freedoms of the data subject;

  • b.

    a data protection impact assessment referred to in Article 4c(1) shows that the processing would present a high risk if the controller does not take measures to mitigate the risk.

• 2

  The Autoriteit persoonsgegevens may draw up a list of the processing operations for which consultation is required, pursuant to the first paragraph.

• 3

  The controller shall provide the Autoriteit persoonsgegevens with the data protection impact assessment referred to in Article 4c and, upon request, any other information enabling the Autoriteit persoonsgegevens to assess the compliance of the processing and, in particular, the risks for the protection of personal data of the data subject and the safeguards involved.

• 4

  If the Autoriteit persoonsgegevens is of the opinion that the intended processing of police data referred to in the first paragraph does not comply with the provisions of or under this Act, it shall, within a period not exceeding six weeks, issue a written opinion to the controller and, where appropriate, to the processor.

• 5

  The period referred to in the fourth paragraph may be extended by one month, taking into account the complexity of the intended processing. In this case, the controller and, where applicable, the processor, shall be notified of the extension and the reasons for it within one month of receipt of the request.