Where an impact assessment shows high risk that the controller cannot mitigate, it must seek the Commissioner's opinion before processing, providing the responsibilities of controllers, joint controllers and processors (especially in a group), the purposes and means, the nature and effects of the risks, the measures and safeguards, the DPO's contact details and anything else requested. The Commissioner gives a written opinion within 60 days, extendable by up to 45 with reasons notified within 30, the clock pausing while information is awaited, and may use its corrective powers. Separately, controllers must consult and obtain the Commissioner's prior authorisation for processing to perform a task in the public interest, including social protection and public health.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.