GDPR Article 36 outlines an organisation’s obligation to consult with a ‘supervisory authority’ before carrying out a DPIA (see Article 35), so as to further protect the rights and freedoms of data subjects throughout the processing operation.
Prior Consultation
- The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.
- Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The supervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation.
- When consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with:
- (a) where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings;
- (b) the purposes and means of the intended processing;
- (c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;
- (d) where applicable, the contact details of the data protection officer;
- (e) the data protection impact assessment provided for in Article 35; and
- (f) any other information requested by the supervisory authority.
- Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing.
- Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health.
Prior Consultation
- The controller shall consult the Commissioner prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.
- Where the Commissioner is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the Commissioner shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The Commissioner shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. Those periods may be suspended until the Commissioner has obtained information it has requested for the purposes of the consultation.
- When consulting the Commissioner pursuant to paragraph 1, the controller shall provide the supervisory authority with:
- (a) where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings;
- (b) the purposes and means of the intended processing;
- (c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;
- (d) where applicable, the contact details of the data protection officer;
- (e) the data protection impact assessment provided for in Article 35; and
- (f) any other information requested by the supervisory authority.
- The relevant authority must consult the Commissioner during the preparation of a proposal for a legislative measure to be adopted by Parliament, the National Assembly for Wales, the Scottish Parliament or the Northern Ireland Assembly, or of a regulatory measure based on such a legislative measure, which relates to processing.
4A. In paragraph 4, “the relevant authority” means- (a) in relation to a legislative measure adopted by Parliament, or a regulatory measure based on such a legislative measure, the Secretary of State; (b) in relation to a legislative measure adopted by the National Assembly for Wales, or a regulatory measure based on such a legislative measure, the Welsh Ministers; (c) in relation to a legislative measure adopted by the Scottish Parliament, or a regulatory measure based on such a legislative measure, the Scottish Ministers; (d) in relation to a legislative measure adopted by the Northern Ireland Assembly, or a regulatory measure based on such a legislative measure, the relevant Northern Ireland Department.- Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health.
100% of our users achieve ISO 27001 certification first time
In this section we talk about GDPR Articles 36 (1), 36 (2), 36 (3)(a), 36 (3)(b), 36 (3)(c), 36 (3)(d), 36 (3)(e), 36 (3)(f) and 36 (5)
PII and privacy protection has the potential to impact a large number of employees, users, customers, both internally and externally.
Organisations need to gain a firm understanding of the needs of any affected personnel and what ISO deems as ‘interested parties’.
Organisation’s need to establish and document:
Organisations should also take into account any legal, regulatory or contractual obligations, alongside practical and operational requirements.
When implementing a PIMS, organisations need to map out a list of interested parties that are either affected by a PIMS, or have a role to play in processing PII.
Where PII is concerned, an interested party could be one of the following (but not limited to):
It’s important to note that PII requirements – as related to a PIMS – often emanate from a wide range of sources, including:
It can often be difficult for governing and regulatory organisations to confirm adherence to published privacy protection standards on the part of an organisation, in its role as a PII processor and controller.
As such, organisations need to expect such bodies to call for independent reviews of any relevant Management System, in order to satisfy their own auditing requirements.
In this section we talk about GDPR Articles 36 (1), 36 (3)(a), 36 (3)(b), 36 (3)(c), 36 (3)(d), 36 (3)(e), 36 (3)(f) and 36 (5)
PII processing is a risk-heavy business function that needs to be thoroughly assessed to ensure the integrity, authenticity and legality of the data being processed.
Depending on the jurisdiction, some organisations will need to abide by a categorical list of scenarios where a privacy impact assessment is required, such as:
Organisations need to establish what constitutes an adequate impact assessment, including (but not limited to):
| GDPR Article | ISO 27701 Clause | ISO 27701 Supporting Clauses |
|---|---|---|
| EU GDPR Articles 36 (1) to 36 (5) | ISO 27701 5.2.2 | None |
| EU GDPR Articles 36 (1), 36 (3)(a), 36)(3)(b), 36 (3)(c), 36 (3)(d), 36 (3)(e), 36 (3)(f) and 36 (5) | ISO 27701 7.2.5 | None |
Support wider business decisions. With all your data in one place, designed with collaboration in mind, you’ll be well equipped to make the right decisions at the right time.
Stay ahead of change. Risks are not static, so your tools need to be able to adapt. Effortlessly address threats and opportunities using an integrated and dynamic tool which simplifies identification, evaluation, and treatment of risk on a continual basis.
Find out more by booking a demo.
Book a tailored hands-on session
based on your needs and goals
Book your demo
