§ 64 HDSIG
Prior Consultation of the Hessian Data Protection Commissioner
(1)Prior to the commissioning of newly created filing systems, the controller shall consult the Hessian Data Protection Commissioner where 1. a data protection impact assessment under § 62 indicates that the processing would result in a high risk to the rights and freedoms of the data subjects unless the controller takes measures to mitigate the risk, or 2. the type of processing, in particular the use of new technologies, mechanisms or procedures, results in a high risk to the rights and freedoms of the data subjects. The Hessian Data Protection Commissioner may draw up a list of processing operations that are subject to the requirement of prior consultation under sentence 1. § 59 para. 1 sentence 2 shall apply accordingly.
(2)In the case of para. 1, the following shall be submitted to the Hessian Data Protection Commissioner: 1. the data protection impact assessment carried out pursuant to § 62, 2. where applicable, information on the respective competences of the controller, the joint controllers and the processors involved in the processing, 3. information on the purposes and means of the intended processing, 4. information on the measures and safeguards provided for to protect the rights and freedoms of the data subjects, and 5. the contact details of the data protection officer. Upon request, the Hessian Data Protection Commissioner shall be provided with all other information he or she requires to assess the lawfulness of the processing and, in particular, the risks to the protection of the personal data of the data subjects and the related safeguards.
(3)Where the Hessian Data Protection Commissioner is of the opinion that the intended processing would violate legal requirements, in particular because the controller has not sufficiently identified or mitigated the risk, he or she may, within a period of up to six weeks after receipt of the request for consultation, submit written recommendations to the controller and, where applicable, the processor on what measures should still be taken. The Hessian Data Protection Commissioner may extend that period by one month where the intended processing is particularly complex. He or she shall, within one month of receipt of the request for consultation, inform the controller and, where applicable, the processor of the extension, together with the reasons for the delay.
(4)Where the intended processing is of significant importance for the performance of the controller's tasks and is therefore particularly urgent, the controller may commence the processing after the start of the prior consultation but before expiry of the period referred to in para. 3. In this case, the recommendations of the Hessian Data Protection Commissioner shall be taken into account subsequently and the nature and manner of the processing shall be adapted accordingly where necessary.
(5)The Hessian Data Protection Commissioner shall be consulted in the preparation of a proposal for a legislative measure to be adopted by the Landtag or of regulatory measures based on such legislative measures, where they concern the processing of personal data. zur Einzelansicht § 64