§ 69 BDSG
Consultation of the Federal Commissioner
(1)The controller shall consult the Federal Commissioner prior to processing where a data protection impact assessment pursuant to Section 67 indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons.
(2)The Federal Commissioner shall, where he or she is of the opinion that the intended processing referred to in Subsection (1) would violate the provisions of this Part, in particular where the controller has insufficiently identified or mitigated the risk, provide written advice to the controller within a period of up to six weeks of receipt of the request for consultation and may use his or her powers under Section 16. That period may be extended by one month, taking into account the complexity of the intended processing. The Federal Commissioner shall inform the controller of any such extension within one month of receipt of the request for consultation, together with the reasons for the delay.
(3)Where the Federal Commissioner is of the opinion that the processing planned in accordance with Subsection (1) would violate this Part, in particular where the controller has insufficiently identified or mitigated the risk, the Federal Commissioner may exercise his or her powers under Section 16.
(4)The Federal Commissioner shall be consulted during the preparation of a proposal for a legislative measure to be adopted by the German Bundestag or of a regulatory measure based on such a legislative measure, which relates to the processing of personal data.