Prior Consultation

Legal Framework

Article 36 GDPR establishes the prior consultation mechanism as a final safeguard within the GDPR's risk-based accountability framework. Where a Data Protection Impact Assessment under Article 35 indicates that processing would result in high residual risk to data subjects' rights and freedoms—and the controller cannot sufficiently mitigate that risk through technical and organizational measures—the controller must consult the supervisory authority before commencing processing.

The consultation requires the controller to submit: the purposes and means of the intended processing, the DPIA outcomes, and any other information the supervisory authority requests to assess compliance. The authority then has a window of up to eight weeks (extendable by six further weeks for complex cases) to issue written advice and, where appropriate, exercise corrective powers under Article 58. Processing may not begin until this process concludes.

Recital 95 clarifies that processors bear a supporting obligation: where necessary and upon the controller's request, processors must assist in fulfilling both DPIA and prior consultation requirements. This reflects the shared-responsibility model embedded throughout the GDPR.

Key Developments

The CJEU's ruling in Wirtschaftsakademie Schleswig-Holstein established that joint controllership arises wherever a party participates in determining the purposes and means of processing—even through parameter configuration on a third-party platform. This has direct implications for prior consultation: where multiple controllers jointly determine high-risk processing, the consultation obligation attaches to each party involved in that determination, and coordination is essential.

The Worten decision reinforces that necessity and proportionality assessments are not abstract exercises. The Court examined whether data collection served a legitimate legal obligation and whether access was appropriately restricted. This proportionality analysis feeds directly into the DPIA stage that triggers prior consultation—controllers must demonstrate that no less intrusive alternative achieves the same objective before residual risk can even be assessed.

CNIL's enforcement actions against Cosmospace (€250,000) and KG COM (€150,000) illustrate the financial exposure when controllers engage in high-risk processing—here, large-scale collection of sensitive personal data through clairvoyance and fortune-telling services—without adequate impact assessment or supervisory consultation. Both cases signal that DPAs treat the failure to escalate residual high risk through prior consultation as a serious accountability failure, not a procedural technicality.

The Dutch DPA's published decisions on prior consultation requests demonstrate that authorities expect substantive submissions, not pro forma notifications. The EDPB's broader work programme signals continued emphasis on streamlining consultation processes while maintaining rigorous substantive review.

Practical Guidance

• Trigger assessment through DPIA first: Prior consultation is only required when a completed Article 35 DPIA demonstrates residual high risk. Document why mitigation measures are insufficient before approaching the authority.

• Identify all controllers before submitting: Apply the Wirtschaftsakademie standard to determine whether joint controllership exists. All parties participating in determining purposes and means share the consultation obligation—coordinate submissions to avoid conflicting positions.

• Prepare a proportionality file: Following Worten, include a necessity analysis demonstrating that no less intrusive processing alternative exists. Restrict access scope to what each legal obligation requires.

• Engage processors early: Under Recital 95, formally request processor assistance in assembling the consultation dossier. Contractual provisions should explicitly allocate responsibility for providing technical documentation.

• Suspend processing timelines: Build the statutory eight-week consultation period (plus potential six-week extension) into project planning. Do not treat the consultation window as negotiable or concurrent with processing commencement.