Service provided by the Federal Ministry of Justice and the Federal Office of Justice ‒ www.gesetze-im-internet.de 4. the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with the law. (5) Where necessary, the controller shall carry out a review to assess whether processing is performed in accordance with the data protection impact assessment. Section 68 Cooperation with the Federal Commissioner The controller shall cooperate with the Federal Commissioner in carrying out the latter’s tasks. Section 69 Prior consultation of the Federal Commissioner (1) The controller shall consult the supervisory authority prior to processing which will form part of a new filing system if 1. a data protection impact assessment pursuant to Section 67 indicates that the processing would result in a substantial risk to the legally protected interests of data subjects in the absence of measures taken by the controller to mitigate the risk; or 2. the type of processing, in particular, where using new technologies, mechanisms or procedures, involves a substantial risk to the legally protected interests of data subjects. The Federal Commissioner may draw up a list of the processing operations which are subject to prior consultation pursuant to the first sentence. (2) In the case of subsection 1, the Federal Commissioner shall be presented with 1. the data protection impact assessment carried out pursuant to Section 67; 2. where applicable, information on the respective responsibilities of the controller, joint controllers and processors involved in the processing; 3. information on the purposes and means of the envisaged processing; 4. information on the measures and safeguards intended to protect the legally protected interests of the data subjects; and 5. the name and contact details of the data protection officer. On request, the Federal Commissioner shall be given any other information he or she requires to assess the lawfulness of the processing and, in particular, the existing risks to the protection of the data subjects’ personal data and the related safeguards. (3) If the Federal Commissioner believes that the planned processing would violate the law, in particular because the controller has not sufficiently identified the risk or has not taken sufficient measures to mitigate the risk, he or she may provide, within a period of up to six weeks of receipt of the request for consultation, written advice to the controller and, where applicable, to the processor, as to which additional measures should be taken. The Federal Commissioner may extend this period by a month, if the planned processing is especially complex. In this case, the Federal Commissioner shall inform the controller and, where applicable, the processor of the extension within one month of receipt of the request for consultation. (4) If the envisaged processing has substantial significance for the controller’s performance of tasks and is therefore especially urgent, the controller may initiate processing after the consultation has started but before the period referred to in subsection 3, first sentence, has expired. In this case, the recommendations of the Federal Commissioner shall be taken into account after the fact, and the way the processing is carried out shall be adjusted where applicable. Page 36 of 43