(1) (2) (3) (4) 59. (1) (2) Where processing operations may result in a risk to the rights and freedoms of data subjects by virtue of their nature, scope, context and purposes, every data controller or data processor shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. The processing operations referred to in sub-Article (1) of this Article are: (a) a systematic and extensive evaluation of personal aspects relating to individuals which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the individual or significantly affect the individual; (b) processing on a large scale of sensitive personal data; (c) a systematic monitoring of a publicly accessible area on a large scale; and (d) any other processing operations for which consultation with the Commission is required. An assessment shall include: (a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the data controller or data processor; (b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes; (c) an assessment of the risks to the rights and freedoms of data subjects; and (d) the measures envisaged to address the risks and the safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Proclamation, taking into account the rights and legitimate interests of data subjects and other persons concerned. Where appropriate, the data controller or data processor shall seek the views of data subjects on the intended processing, without prejudice to the protection of commercial or public interests or the security of the processing operations. Prior Authorization and Consultation Every data controller or data processor shall obtain authorization from the Commission prior to processing personal data in order to ensure compliance of the intended processing with this Proclamation and in particular to mitigate the risks involved for the data subjects where a data controller or data processor cannot provide for the appropriate safeguards in relation to the transfer of personal data to a third party jurisdiction. The data controller or data processor shall consult the Commission prior to processing personal data in order to ensure compliance of the intended processing with this Proclamation and in particular to mitigate the risks involved for the data subjects where: (a) a data protection impact assessment indicates that processing operations are by virtue of their nature, scope or purposes, likely to present a high risk; or (b) the Commission considers it necessary to carry out a prior consultation on processing operations that are likely to present a high risk to the rights and freedoms of data subjects by virtue of their nature, scope or purposes. 26