What actions can the President of the PDPO take in relation to the received application?
- After receiving the request
If the request for prior consultation does not fulfil the requirements set out in Art. 36(3) of the Regulation 2016/679 and Art. 63 of the Act of 14 June 1960 - Code of Administrative Procedure, the President of the Personal Data Protection Office shall inform about not providing consultation, indicating the reasons therefore (Art. 57 § 3 of the Act on the Protection of Personal Data).
The authority can act as above, if the request implies that the data protection impact assessment has shown that the processing will not result in a high risk.
- During consultations
During the proceedings conducted in the course of prior consultation, the President of the Personal Data Protection Office may request the applicant to provide additional information that will be needed for the purposes of consultation (Art.36(2) of the GDPR).
- After conducting consultations
After conducting consultation, the supervisory authority may provide written advice to the controller and, where applicable, to the processor (Art. 36(2) of the GDPR). In justified cases, regardless of the issued recommendations, the authority may use the powers referred to in art. 58 of the GDPR, in particular: to issue warnings that intended processing operations are likely to infringe provisions of this Regulation, to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, to impose a temporary or definitive limitation including a ban on processing.
- Deadlines
The supervisory authority shall examine the request within period of up to eight weeks of receipt of the request for consultation. Due to the complexity of the intended processing, the authority may extend the deadline by additional six weeks. Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation. (Art.36(2) of the GDPR).