S.L. 586.8 Art. 28Prior consultation with the Commissioner. 18 [S.L.

(1) The controller or the processor shall consult with the Commissioner prior to processing of personal data which will form part of a new filing system to be created, where: FOR THE PURPOSES OF THE PREVENTION, INVESTIGATION, DETECTION OR PROSECUTION OF CRIMINAL OFFENCES OR THE 586.08 EXECUTION OF CRIMINAL PENALTIES

(a) a data protection impact assessment as provided for in regulation 27 indicates that the processing would result in a high risk, in the absence of measures taken by the controller to mitigate the risk; or

(b) the type of processing, in particular, where using new technologies, mechanisms or procedures, involves a high risk to the rights and freedoms of data subjects.

(2) The Commissioner shall be consulted during the preparation of a proposal for a legislative measure to be adopted by Parliament or of a regulatory measure based on such a legislative measure, which relates to processing.

(3) The Commissioner may establish a list of the processing operations which are subject to prior consultation pursuant to sub-regulation (1).

(4) The controller shall provide the Commissioner with the data protection impact assessment pursuant to regulation 27 and, on request, with any other information to allow the Commissioner to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards.

(5) Where the Commissioner is of the opinion that the intended processing referred to in sub-regulation (1) would infringe any regulation under these regulations, in particular where the controller has insufficiently identified or mitigated the risk, the Commissioner shall, within six weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable, to the processor, and may use any of its powers referred to in regulation 49:

Provided that such period may be extended by a month, taking into account the complexity of the intended processing.

(6) The Commissioner shall inform the controller and, where applicable, the processor of any extension as provided for in the proviso of sub-regulation (5) within one month of receipt of the request for consultation, together with the reasons for the delay.