Regulation (EC) No 45/2001 of the European Parliament and of the Council (repealed)Show full title

SECTION 9 U.K. PRIOR CHECKING BY THE EUROPEAN DATA PROTECTION SUPERVISOR AND OBLIGATION TO COOPERATE

Article 27 U.K. Prior checking

1. Processing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes shall be subject to prior checking by the European Data Protection Supervisor.

2. The following processing operations are likely to present such risks:

(a) processing of data relating to health and to suspected offences, offences, criminal convictions or security measures;

(b) processing operations intended to evaluate personal aspects relating to the data subject, including his or her ability, efficiency and conduct;

(c) processing operations allowing linkages not provided for pursuant to national or Community legislation between data processed for different purposes;

(d) processing operations for the purpose of excluding individuals from a right, benefit or contract.

3. The prior checks shall be carried out by the European Data Protection Supervisor following receipt of a notification from the Data Protection Officer who, in case of doubt as to the need for prior checking, shall consult the European Data Protection Supervisor.

4. The European Data Protection Supervisor shall deliver his or her opinion within two months following receipt of the notification. This period may be suspended until the European Data Protection Supervisor has obtained any further information that he or she may have requested. When the complexity of the matter so requires, this period may also be extended for a further two months, by decision of the European Data Protection Supervisor. This decision shall be notified to the controller prior to expiry of the initial two-month period.

If the opinion has not been delivered by the end of the two-month period, or any extension thereof, it shall be deemed to be favourable.

If the opinion of the European Data Protection Supervisor is that the notified processing may involve a breach of any provision of this Regulation, he or she shall where appropriate make proposals to avoid such breach. Where the controller does not modify the processing operation accordingly, the European Data Protection Supervisor may exercise the powers granted to him or her under Article 47(1).

5. The European Data Protection Supervisor shall keep a register of all processing operations that have been notified to him or her pursuant to paragraph 2. The register shall contain the information referred to in Article 25 and shall be open to public inspection.

Article 28 U.K. Consultation

1. The Community institutions and bodies shall inform the European Data Protection Supervisor when drawing up administrative measures relating to the processing of personal data involving a Community institution or body alone or jointly with others.

2. When it adopts a legislative proposal relating to the protection of individuals' rights and freedoms with regard to the processing of personal data, the Commission shall consult the European Data Protection Supervisor.

Article 29 U.K. Obligation to provide information

The Community institutions and bodies shall inform the European Data Protection Supervisor of the measures taken further to his or her decisions or authorisations as referred to in Article 46(h).

Article 30 U.K. Obligation to cooperate

At his or her request, controllers shall assist the European Data Protection Supervisor in the performance of his or her duties, in particular by providing the information referred to in Article 47(2)(a) and by granting access as provided in Article 47(2)(b).

Article 31 U.K. Obligation to react to allegations

In response to the European Data Protection Supervisor's exercise of his or her powers under Article 47(1)(b), the controller concerned shall inform the Supervisor of its views within a reasonable period to be specified by the Supervisor. The reply shall also include a description of the measures taken, if any, in response to the remarks of the European Data Protection Supervisor.