Rina Steenkamp - Privacy and technology

My annotated General Data Protection Regulation

[Additional information]

[Directive 95/46/EC]

[Article 11]

Chapter II General rules on the lawfulness of the processing of personal data

Section IV Information to be given to the data subject

Article 11 Information where the data have not been obtained from the data subject
Article 11(1)

1. Where the data have not been obtained from the data subject, Member States shall provide that the controller or his representative must at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the following information, except where he already has it:

Article 11(2)

2. Paragraph 1 shall not apply where, in particular for processing for statistical purposes or for the purposes of historical or scientific research, the provision of such information proves impossible or would involve a disproportionate effort or if recording or disclosure is expressly laid down by law. In these cases Member States shall provide appropriate safeguards.

[Source: Directive 95/46/EC]

Cross-reference

Article 11

Article 11 Directive 95/46/ECArticle 14(5) point(a) GDPR

[...] except where he already has it: [...]

5. Paragraphs 1 to 4 shall not apply, where:

  • (a) the data subject has already the information referred to in paragraphs 1, 2 and 3;
 Artikel 34 lid 1 Wbp

[...] tenzij de betrokkene daarvan reeds op de hoogte is: [...]

1. Indien persoonsgegevens worden verkregen op een andere wijze dan bedoeld in artikel 33, deelt de verantwoordelijke de betrokkene de informatie mede, bedoeld in het tweede en derde lid, tenzij deze reeds daarvan op de hoogte is:

  • op het moment van vastlegging van hem betreffende gegevens, of
  • wanneer de gegevens bestemd zijn om te worden verstrekt aan een derde, uiterlijk op het moment van de eerste verstrekking.

[Context: Article 14 GDPR, Artikel 34 Wbp]

Article 11(1) point (a)

Article 11(1) point (a) Directive 95/46/ECArticle 14(1) point (a) GDPR

(a) the identity of the controller and of his representative, if any;

(a) the identity and the contact details of the controller and, if any, of the controller's representative, of the data protection officer;

 Artikel 34 lid 2 Wbp

a) de identiteit van de voor de verwerking verantwoordelijke en, in voorkomend geval, van diens vertegenwoordiger,

De verantwoordelijke deelt de betrokkene zijn identiteit [...] mede.

[Context: Article 14 GDPR, Artikel 34 Wbp]

Article 11(1) point (b)

Article 11(1) point (b) Directive 95/46/ECArticle 14(1) point (b) GDPR

(b) the purposes of the processing;

(b) the purposes of the processing for which the personal data are intended, as well as information regarding the security of the processing of personal data, including the contract terms and general conditions where the processing is based on point (b) of Article 6(1) and where applicable, information on how they implement and meet the requirements of point f of Article 6(1);

 Artikel 34 lid 2 Wbp

b) de doeleinden van de verwerking,

De verantwoordelijke deelt de betrokkene [...] de doeleinden van de verwerking mede.

[Context: Article 14 GDPR, Artikel 34 Wbp]

Article 11(1) point (c)

Article 11(1) point (c) Directive 95/46/ECArticle 14(1) points (c), etc. GDPR

(c) any further information such as

  • - the categories of data concerned,
  • - the recipients or categories of recipients,
  • - the existence of the right of access to and the right to rectify the data concerning him

in so far as such further information is necessary, having regard to the specific circumstances in which the data are processed, to guarantee fair processing in respect of the data subject.

1. Where personal data relating to a data subject are collected, the controller shall provide the data subject with at least the following information, after the particulars pursuant to Article 13a have been provided:

  • (c) the period for which the personal data will be stored, or if this is not possible, the criteria used to determine this period;
  • (d) the existence of the right to request from the controller access to and rectification or erasure of the personal data concerning the data subject to object to the processing of such personal data, or to obtain data;
  • (e) the right to lodge a complaint to the supervisory authority and the contact details of the supervisory authority;
  • (f) the recipients or categories of recipients of the personal data;
  • (g) where applicable, that the controller intends to transfer the data to a third country or international organisation and on the existence or absence of an adequacy decision by the Commission, or in case of transfers referred to in Article 42, Article 43, or point (h) of Article 44(1), reference to the appropriate safeguards and the means to obtain a copy of them;
  • (ga) where applicable, information about the existence of profiling, of measures based on profiling, and the envisaged effects of profiling on the data subject;
  • (gb) meaningful information about the logic involved in any automated processing;
  • (h) any further information which is necessary to guarantee fair processing in respect of the data subject, having regard to the specific circumstances in which the personal data are collected or processed, in particular the existence of certain processing activities and operations for which a personal data impact assessment has indicated that there may be a high risk;
  • (ha) where applicable, information whether personal data was provided to public authorities during the last consecutive 12-month period.
 Artikel 34 lid 3 Wbp

c) verdere informatie zoals

  • - de betrokken gegevenscategorieën;
  • - de ontvangers of de categorieën ontvangers;
  • - het bestaan van een recht op toegang tot zijn eigen persoonsgegevens en op rectificatie van deze gegevens,

voor zover die, met inachtneming van de specifieke omstandigheden waaronder de verdere informatie verzameld wordt, nodig is om tegenover de betrokkene een eerlijke verwerking te waarborgen.

3. De verantwoordelijke verstrekt nadere informatie voor zover dat gelet op de aard van de gegevens, de omstandigheden waaronder zij worden verkregen of het gebruik dat ervan wordt gemaakt, nodig is om tegenover de betrokkene een behoorlijke en zorgvuldige verwerking te waarborgen.

[Context: Article 14 GDPR, Artikel 34 Wbp]

Article 11(2)

Article 11(2) Directive 95/46/ECArticle 14(5) point (b) GDPR

2. Paragraph 1 shall not apply where, in particular for processing for statistical purposes or for the purposes of historical or scientific research, the provision of such information proves impossible or would involve a disproportionate effort [...]. In these cases Member States shall provide appropriate safeguards.

5. Paragraphs 1 to 4 shall not apply, where:

  • (b) the data are processed for historical, statistical or scientific research purposes subject to the conditions and safeguards referred to in Articles 81 and 83, are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort and the controller has published the information for anyone to retrieve
 Article 14(5) point (c) GDPR

[...] or if recording or disclosure is expressly laid down by law. [...]

  • (c) the data are not collected from the data subject and recording or disclosure is expressly laid down by law to which the controller is subject, which provides appropriate measures to protect the data subject's legitimate interests, considering the risks represented by the processing and the nature of the personal data;
 Artikel 34 lid 4 Wbp

2. Het bepaalde in lid 1 is niet van toepassing indien, met name voor statistische doeleinden of voor historisch of wetenschappelijk onderzoek, verstrekking van informatie aan de betrokkene onmogelijk blijkt of onevenredig veel moeite kost [...]. In deze gevallen zorgen de Lid-Staten voor passende waarborgen.

4. Het eerste lid is niet van toepassing indien mededeling van de informatie aan de betrokkene onmogelijk blijkt of een onevenredige inspanning kost. In dat geval legt de verantwoordelijke de herkomst van de gegevens vast.

 Artikel 34 lid 5 Wbp

[...] of indien de registratie of verstrekking bij wet is voorgeschreven. [...]

5.Het eerste lid is evenmin van toepassing indien de vastlegging of de verstrekking bij of krachtens de wet is voorgeschreven. In dat geval dient de verantwoordelijke de betrokkene op diens verzoek te informeren over het wettelijk voorschrift dat tot de vastlegging of verstrekking van de hem betreffende gegevens heeft geleid.

[Context: Article 14 GDPR, Artikel 34 Wbp]