In the decision dated December 18, 2018, GZ: DSBD485.001/0003-DSB/2018, the data protection authority had to deal with the question of when a claim
to prior consultation pursuant to Art. 36 GDPR. The applicant intended to install twelve video surveillance cameras in a business park for the purpose of property and object protection. The data protection authority was consulted after the applicant’s data protection impact assessment showed that there were low to high risks for data subjects as a result of the planned data processing. However, due to the remedial measures planned in the data protection impact assessment, the applicant was ultimately able to classify all identified risks as very low. The data protection authority rejected the request for prior consultation pursuant to Art. 36 GDPR, holding that
according to para. 1 leg. cit. consultation of the data protection authority applies only in those cases where the controller fails to mitigate the identified risks to an acceptable level. The consultation procedure, on the other hand, does not serve to obtain confirmation from the data protection authority that the measures taken are indeed to be regarded as suitable for limiting the identified risks. Such an assessment is the sole responsibility of the person in charge. The decision is legally binding.