사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill gdpr-prior-consultation시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
Conducting Prior Consultation Process
Overview
Article 36 requires controllers to consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller is unable to sufficiently mitigate that risk.
When Prior Consultation Is Required
Prior consultation is mandatory when all of the following conditions are met:
- A DPIA has been conducted under Art. 35.
- The DPIA identifies high risks to data subjects' rights and freedoms.
- All reasonably available mitigation measures have been applied.
- Residual risk remains high despite mitigation efforts.
Required Documentation (Art. 36(3))
The controller must provide:
- Respective responsibilities of controller, joint controllers, and processors
- Purposes and means of the intended processing
- Measures and safeguards to protect data subjects
- DPO contact details
- The completed DPIA under Art. 35
- Any other information the authority requests
Timeline
| Phase | Duration | Reference |
|---|---|---|
| Authority initial response period | 8 weeks from receipt | Art. 36(2) |
| Extension for complex cases | Up to 6 additional weeks | Art. 36(2) |
| Maximum total period | 14 weeks | Art. 36(2) |
| Processing commencement | Only after advice received or deadline expired | Art. 36(2) |
Consultation Process
Step 1: Pre-Submission Preparation
- Verify the DPIA is complete with all Art. 35(7) mandatory elements.
- Confirm all available mitigation measures have been documented.
- Document why residual risk remains high despite mitigation.
- Obtain DPO review and sign-off.
- Prepare the submission package with all Art. 36(3) documents.
Step 2: Submission
- Submit to the competent supervisory authority (lead authority for cross-border processing under Art. 56).
- Use the authority's prescribed format if available.
- Retain proof of submission with date stamp.
Step 3: Authority Engagement
- Respond promptly to requests for additional information.
- Track the 8-week deadline and any extension notifications.
- Do not commence processing until advice is received or deadline expires.
Step 4: Outcome Handling
| Outcome | Action |
|---|---|
| Authority approves | Proceed subject to any conditions specified |
| Authority provides recommendations | Implement recommendations, document compliance |
| Authority objects or restricts | Do not proceed; revise processing design; resubmit if appropriate |
| No response within deadline | Document that consultation was submitted and deadline expired; may proceed |
Member State Variations
Art. 36(5) permits Member State law to require prior consultation for processing in the public interest, including social protection and public health. Controllers must check local implementing legislation.
Common Reasons for Triggering Prior Consultation
- Large-scale biometric identification systems
- Systematic public area surveillance with facial recognition
- Processing of genetic data at population scale
- Automated decision-making with legal or similarly significant effects where mitigation is insufficient
- Novel technology processing with unpredictable risk profiles
