Article 48 — Prior Authorization and Consultation

1/ Every data controller or data processor shall obtain authorization from the Authority prior to processing personal data in order to ensure compliance of the intended processing with this Proclamation and in particular to mitigate the risks involved for the data subjects where a data controller or data processor cannot provide for the appropriate safeguards in relation to the transfer of personal data to a third party jurisdiction. 2/ The data controller or data processor shall consult the Authority prior to processing personal data in order to ensure compliance of the intended processing with this Proclamation and in particular to mitigate the risks involved for the data subjects where: a) a data protection impact assessment indicates that processing operations are by virtue of their nature, scope or purposes, likely to present a high risk; or b) The Authority considers it necessary to carry out a prior consultation on processing operations that are likely to present a high risk to the rights and freedoms of data subjects by virtue of their nature, scope or purposes. [[[ 3/ Where the Authority is of the opinion that the intended processing does not comply with this Proclamation, it shall prohibit the intended processing and make appropriate proposals to remedy such non-compliance. 4/ The Authority shall make public a list of the processing operations which are subject to prior consultation in accordance with Sub-Article (2) lit. (b) Of this Article. 5/The data controller or data processor shall provide the Authority with the data protection impact assessment and, whenever requested, any other information.