Rina Steenkamp - Privacy and technology
Chapter III Rights of the data subject
Section 2 Information and access to data
1. Where personal data relating to a data subject are collected, the controller shall provide the data subject with at least the following information, after the particulars pursuant to Article 13a have been provided:
2. Where the personal data are collected from the data subject, the controller shall inform the data subject, in addition to the information referred to in paragraph 1, whether the provision of personal data is mandatory or optional, as well as the possible consequences of failure to provide such data.
2a. In deciding on further information which is necessary to make the processing fair under 1(h), controllers shall have regard to any relevant guidance under Article 38.
3. Where the personal data are not collected from the data subject, the controller shall inform the data subject, in addition to the information referred to in paragraph 1, from which source the specific personal data originate. If personal data originates from publicly available sources, a general indication may be given.
4. The controller shall provide the information referred to in paragraphs 1, 2 and 3:
5. Paragraphs 1 to 4 shall not apply, where:
6. In the case referred to in point (b) of paragraph 5, the controller shall provide appropriate measures to protect the data subject's rights or legitimate interests.
7. (deleted)
8. (deleted)
[Source: October 2013]
(48) The principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes, how long the data will be likely stored for each purpose, if the data are to be transferred to third parties or third countries, on the existence of measures to object and of the right of access, rectification or erasure and on the right to lodge a complaint. Where the data are collected from the data subject, the data subject should also be informed whether they are obliged to provide the data and of the consequences, in cases they do not provide such data. This information should be provided, which can also mean made readily available, to the data subject after the provision of simplified information in the form of standardised icons.
(49) The information in relation to the processing of personal data relating to the data subject should be given to them at the time of collection, or, where the data are not collected from the data subject, within a reasonable period, depending on the circumstances of the case. Where data can be legitimately disclosed to another recipient, the data subject should be informed when the data are first disclosed to the recipient.
(50) However, it is not necessary to impose this obligation where the data subject already knows this information, or where the recording or disclosure of the data is expressly laid down by law, or where the provision of information to the data subject proves impossible or would involve disproportionate efforts.
[Source: October 2013 | Notes: Recitals | Context: Recitals]
Article 14 further specifies the controller's information obligations towards the data subject, building on Articles 10 and 11 of Directive 95/46/EC, providing additional information to the data subject, including on the storage period, the right to lodge a complaint, in relation to international transfers and to the source from which the data are originating. It also maintains the possible derogations in Directive 95/46/EC, e.g. there will be no such obligation if the recording or disclosure are expressly provided by law. This could apply for example in proceedings by competition authorities, tax or customs administrations, or services competent for social security matters.
[Source: January 2012 | Context: Proposal from the European Commission]
1. Where personal data relating to a data subject are collected, the controller shall provide the data subject with at least the following information:
2. Where the personal data are collected from the data subject, the controller shall inform the data subject, in addition to the information referred to in paragraph 1, whether the provision of personal data is obligatory or voluntary, as well as the possible consequences of failure to provide such data.
3. Where the personal data are not collected from the data subject, the controller shall inform the data subject, in addition to the information referred to in paragraph 1, from which source the personal data originate.
4. The controller shall provide the information referred to in paragraphs 1, 2 and 3:
5. Paragraphs 1 to 4 shall not apply, where:
6. In the case referred to in point (b) of paragraph 5, the controller shall provide appropriate measures to protect the data subject's legitimate interests.
7. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying the criteria for categories of recipients referred to in point (f) of paragraph 1, the requirements for the notice of potential access referred to in point (g) of paragraph 1, the criteria for the further information necessary referred to in point (h) of paragraph 1 for specific sectors and situations, and the conditions and appropriate safeguards for the exceptions laid down in point (b) of paragraph 5. In doing so, the Commission shall take the appropriate measures for micro, small and medium-sized-enterprises.
8. The Commission may lay down standard forms for providing the information referred to in paragraphs 1 to 3, taking into account the specific characteristics and needs of various sectors and data processing situations where necessary. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
[Source: January 2012 | Context: Proposal from the European Commission]
(48) The principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes, how long the data will be stored, on the existence of the right of access, rectification or erasure and on the right to lodge a complaint. Where the data are collected from the data subject, the data subject should also be informed whether they are obliged to provide the data and of the consequences, in cases they do not provide such data.
(49) The information in relation to the processing of personal data relating to the data subject should be given to them at the time of collection, or, where the data are not collected from the data subject, within a reasonable period, depending on the circumstances of the case. Where data can be legitimately disclosed to another recipient, the data subject should be informed when the data are first disclosed to the recipient.
(50) However, it is not necessary to impose this obligation where the data subject already disposes of this information, or where the recording or disclosure of the data is expressly laid down by law, or where the provision of information to the data subject proves impossible or would involve disproportionate efforts. The latter could be particularly the case where processing is for historical, statistical or scientific research purposes; in this regard, the number of data subjects, the age of the data, and any compensatory measures adopted may be taken into consideration.
[Source: January 2012 | Notes: Recitals | Context: Proposal from the European Commission, Recitals]
| General Data Protection Regulation: | Directive 95/46/EC: |
|---|---|
| Article 14(1) point (a) | Article 10 point (a) Article 11(1) point (a) |
| Article 14(1) point (b) | Article 10 point (b) Article 11(1) point (b) |
| Article 14(1) points (c), etc. | Article 10 point (c) Article 11(1) point (c) |
| Article 14(5) point (a) | Article 10 points (a), (b) and (c) Article 11(1) points (a), (b) and (c) |
| Article 14(5) points (b) and (c) | Article 11(2) |
Member States shall provide that the controller or his representative must provide a data subject from whom data relating to himself are collected with at least the following information, except where he already has it:
1. Where the data have not been obtained from the data subject, Member States shall provide that the controller or his representative must at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the following information, except where he already has it:
2. Paragraph 1 shall not apply where, in particular for processing for statistical purposes or for the purposes of historical or scientific research, the provision of such information proves impossible or would involve a disproportionate effort or if recording or disclosure is expressly laid down by law. In these cases Member States shall provide appropriate safeguards.