A’ 137/29.08.2019 GOVERNMENT GAZETTE data that have been transmitted by or to the controller of another Member State, the information referred to in paragraph 3 shall be communicated to the controller of that Member State without delay. 7. Further obligations of the controller regarding the notification of personal data breaches shall remain unaffected. Article 64 Communication of a personal data breach to the data subject (Article 31 of the Directive) 1. Where the personal data breach is likely to result in a significant risk to the protected legitimate interests of a natural person, the controller shall communicate the personal data breach to the data subject without delay. 2. When notifying the data subject in accordance with paragraph 1, the nature of the personal data breach shall be described in clear and plain language and the content of points (b), (c) and (d) of paragraph 3 of the previous Article shall be at least indicated. 3. A communication to the data subject shall not be required if any of the following conditions are met: (a) the controller has taken appropriate technical and organisational security measures and has implemented those measures to the personal data affected by the personal data breach. This applies in particular to measures, such as encryption, that render the personal data unintelligible to any person who is not authorised to access it; (b) the controller has taken subsequent measures which ensure protection against personal data breach; or (c) disproportionate efforts are required. In such a case, there shall instead be a public communication or similar measures whereby the data subjects are informed in an equally effective manner. 4. If the controller has not informed the data subject of the personal data breach, the Authority may formally declare that it considers that the conditions of paragraph 3 are not met. In doing so, it should consider the likelihood that the damage will result in a significant risk within the meaning of paragraph 1. 5. The communication to the data subject pursuant to paragraph 1 may be delayed, restricted or omitted subject to the conditions laid down in Article 54(2), except where the interests of the data subject override the significant risk of the breach within the meaning of paragraph 1. Article 65 Assessment of the impact of processing on the protection of personal data (Article 27 of the Directive) 1. If a form of processing, in particular where using new technologies, is likely to result in a significant risk to the protected legitimate interests of the data subjects due to the nature, scope, conditions and purposes of the processing, the controller shall first carry out an assessment of the impact of the envisaged processing for the data subjects. 2. To investigate such processing operations with similar potential for significant risk, a data protection impact 3397 assessment may be carried out jointly. 3. The impact assessment shall take into account the rights of the data subject which are affected by the processing and must contain at least the following: (a) a systematic description of the envisaged operations and purposes of the processing; (b) an assessment of the necessity and proportionality of the processing operations in relation to the intended purposes; (c) an assessment of the risks to the protected legitimate interests of the data subject; and d) the measures to be taken to address the existing risks, including safeguards, security measures and procedures to ensure the protection of personal data and to demonstrate compliance with legal requirements. 4. Where necessary, the controller shall check whether the processing complies with the requirements of the impact assessment. Article 66 Cooperation with the Authority (Article 26 of the Directive) The controller and processor shall cooperate with the Authority in the performance of its tasks. Article 67 Prior consultation of the Authority (Article 28 of the Directive) 1. The controller shall consult the Authority prior to processing personal data which will form part of a new filing system to be created, where: (a) a data protection impact assessment as provided for in Article 65 indicates that the processing would result in a significant risk to the protected legitimate interests of the data subject in the absence of measures taken by the controller to mitigate the risk; or (b) the type of processing, in particular due to the use of new technologies, mechanisms or procedures, involves a significant risk to the protected legitimate interests of the data subject. 2. During the preparation of draft laws or regulations relating to the processing of personal data by competent authorities for the purposes of Article 43 or linked to the processing, the Authority shall be consulted in a timely manner. 3. The Authority may establish a list of the processing operations which are subject to prior consultation pursuant to paragraph 1. The Authority shall communicate this list to the controller. 4. During prior consultation, the Authority shall be provided with: (a) a data protection impact assessment carried out in accordance with Article 65; (b) where applicable, information about the responsibilities of the controller, joint controllers and processors involved; (c) information about the purposes and means of the intended processing; (d) information about the measures and safeguards provided to protect the legitimate interests of the data subjects; and