Prior Consultation (Article 36)
Prior consultation with the supervisory authority
TL;DR
Art. 36 GDPR requires consultation where a DPIA indicates a high residual risk. The supervisory authority has 8 weeks to provide advice (Art. 36(2)), extendable to 14 weeks.
What is prior consultation (Article 36)?
Mandatory content of the consultation (selection under Art. 36(3) GDPR):
- Purposes and means of the intended processing
- Data protection impact assessment (DPIA)
- Measures and safeguards provided to protect data subjects
- Contact details of the data protection officer (where designated) and any other information requested by the supervisory authority
Practical example
A private insurer plans an AI-based risk assessment for life insurance. The DPIA shows a high residual risk. Because a private insurer is a non-public body, it is supervised by the competent state data protection authority (§ 40(1) of the German Federal Data Protection Act (BDSG)) — not by the Federal Commissioner for Data Protection (BfDI), who is responsible only for federal public bodies and certain providers of telecommunications services (§ 9(1) BDSG). The insurer therefore consults the competent state data protection authority before processing begins. If the authority considers that the processing would not comply with the GDPR, it provides written advice within up to eight weeks (extendable by six weeks) and may use its powers under Art. 58 GDPR (Art. 36(2) GDPR).
Competent supervisory authority: Germany and Austria
Art. 36 GDPR applies in identical wording in Germany and Austria; prior consultation takes place with the nationally competent supervisory authority in each case.
Germany
For non-public bodies (for example private companies and insurers), the state data protection authority competent under state law is the correct addressee of the prior consultation (§ 40(1) BDSG). The Federal Commissioner for Data Protection (BfDI) is responsible only for federal public bodies and certain providers of telecommunications services (§ 9(1) BDSG).
Austria
In Austria, the Austrian Data Protection Authority (Datenschutzbehörde, DSB) is the nationally competent independent supervisory authority under Art. 51 GDPR (§ 18(1) of the Austrian Data Protection Act (DSG)). It is therefore also the body responsible for prior consultation under Art. 36 GDPR — for public and non-public controllers alike.