Are you aware of the fact that, before you can process a personal number for a new purpose, process personal data regarding surreptitious surveillance or process criminal data for a third party, you are required to consult the Data Protection Authority prior to such processing? Through a prior consultation, the DPA evaluates whether your organization meets the legal requirements and the foreseen processing is lawful.
Prior Consultation: Why and how does it work?
The Dutch Data Protection Act requires a prior consultation if special privacy risks adhere to the processing activity. Specifically, there are three types of processing:
- The processing of a personal number for any other purpose;
- The processing of personal data from surreptitious surveillance; or
- The processing of criminal data for a third party.
A prior consultation consists of one or two phases. The first phase, the preliminary investigation, takes four weeks. In this phase, the DPA analyses the foreseen processing activities and gives a general ruling. In this phase, the DPA also decides if additional research (phase two) is needed. In an additional investigation, the DPA examines the facts and lawfulness of the processing. The focus is on whether your organization has taken sufficient measures to adequately mitigate the privacy risks resulting from the data processing. This phase can last up to 20 weeks. At the end of this phase, the DPA publishes a draft report, to which interested parties may object to. Thereafter follows a final decision and if approved, you may begin your processing.
What can Considerati do for me?
Given the relatively long time needed to complete a prior consultation, it is important that you start early. Requesting a prior consultation should be done as soon as possible. Considerati has extensive experience with issuing applications and supporting organizations during a prior consultation. First, we establish whether the intended processing meets the requirements of the Dutch Data Protection Act or General Data Protection Regulation. We will also formulate recommendations that, if followed, ensure a positive ending of the prior consultation. Thereafter, Considerati registers the prior consultation request on your behalf at the DPA. During the entire process, Considerati is available to answer all your questions and the questions from the DPA about your intended processing.