Right to Be Informed and Privacy Information Obligation (Articles 13 and 14 GDPR) (Chapter 2, Section 2) — Guide to the GDPR

The right to information about what happens to somebody’s personal data is a fundamental right under the GDPR. This right is represented by specific information obligations on the part of the controller. The information obligation is nothing new – it applied earlier, under the Data Protection Directive, but the GDPR expands and modifies the notification obligation towards data subjects.

The controller has an obligation to inform an individual that their data are processed in four main situations:

We will call here those information obligations collectively as privacy information obligation or ‘PIO’.

Where data are obtained directly from the data subject, the controller is required to provide the following information (Article 13(1) and (2) GDPR):

As can be seen, the list of information that the controller has to provide is impressive.

If the controller obtains data from other sources than the data subject, then on top of the information listed above the controller has to inform the individual of:

Where the controller intends to change or add a purpose for which data are processed it is required to inform the individual of:

In particular when the controller intends to use data possessed due to the performance of a contract for marketing purposes, adequate information is necessary. Interestingly, PIO can be used as a good faith reason to reach to persons we would like to serve marketing through email or other electronic or telecommunications channels telling them about our intent and asking if they consent to receive such content.

Where the controller receives a request for access to data, when executing that request the controller also has to provide the individual with a large amount of information from the list above. In reality, the controller repeats the whole information obligation from Article 13 or 14, respectively. A specific list is provided in Article 15(1) and (2) GDPR.

Below is a brief description of the information that has to be provided in practice with respect to elements of the notification obligation which might cause concern.

If we rely on law as the basis for processing (under Article 6(1)(c) and (e), Article 9(2)(b), (g)–(j) GDPR), a specific provision of law has to be given.

The recipients or categories of recipients have to be stated. This is rather a question of the recipients on the side of the controller because, in functional terms, the recipient might be the data subject themselves or their relatives (e.g., for medical documentation) or so. Within the group of ‘usual suspects’, such as accountants, lawyers, IT personnel, and document archiving companies, it would probably be possible to limit this to stating the category, especially if the service provider structure is widely spread. Let us see that if someone exercises a right to have their data rectified or erased, or processing restricted, then under Article 19 GDPR that individual is entitled to request information as to the identity of all of the recipients. In such a case it is not enough to state the categories, a data controller should indicate specific entities, however.

However, the definition given in Article 4(9) GDPR of ‘recipients’ is unusually broad. Once again, it seems that the GDPR is inconsistent in this regard, as the same words are used in different senses in various provisions. The ‘recipients’ referred to in Article 19 GDPR are, to be reasonable, entities other than processors and other than personnel of the controller and of the processor. This seems to be obvious, but if a specific line of reasoning does have to be formulated, then providing information about a company’s own personnel and processors is like providing information about oneself. Any other interpretation would be difficult to reconcile with the generally applicable rules of civil and economic law and rules on combating unfair competition (business secrets). Nevertheless, prudent controllers prefer to list categories of usual external support functions.

As a result, only information about organisations that have been provided with data on a controller-to-controller (C2C) basis and about ‘external’ natural persons (e.g., an individual’s relatives) should be provided. Those, according to the definition of the ‘recipient’ do not include the request of the Police and other law enforcement bodies (courts, etc.) based on specific provisions of law.

If a company has plans to send data to a third country, a particular recipient has to be specified. Information also has to be provided about whether the recipient’s country is deemed by the European Commission (EC) to ensure an adequate level of personal data protection, mention the safeguards under GDPR provisions on data export, and state how documents confirming proper data protection can be accessed.

Unfortunately, practical application of the PIO relating to the export of data in many cases is not in line with the working and spirit of Articles 13 and 14 GDPR. Apart from those controllers who have just formally realised that ‘their data’ are being exported because their data processors use out of European Union (EU) resources, there are those who apply a freestyle approach just telling their data subjects that everything will be all right. As an example one of the United Kingdom (UK) leading newspapers and news portals provides the users with the following notice on data export (we have substituted the real name with ‘NEWSPAPER’):

Data we collect may be transferred to, stored and processed in any country or territory where one or more of our ‘NEWSPAPER’ group companies or service providers are based or have facilities. While other countries or territories may not have the same standards of data protection as those in your home country, we will continue to protect personal data that we transfer in line with this privacy policy. Whenever we transfer your personal data out of the European Economic Area (EEA), we ensure similar protection and put in place at least one of these safeguards:

We will only transfer your personal data to countries that have been found to provide an adequate level of protection for personal data.
We may also use specific approved contracts with our service providers that are based in countries outside the EEA. These contracts give your personal data the same protection it has in the EEA.
Where we use service providers in the United States, we may transfer personal data to them if they are part of the Privacy Shield scheme, which requires them to provide a similar level of protection of your personal data to what is required in the EEA.

If you are located in the EEA, you may contact us for a copy of the safeguards which we have put in place for the transfer of your personal data outside the EEA’

Such notice does not really say if data are exported or who receives them or where to look for documents constituting appropriate safeguards.

If the decision-making process has been automated and decisions are made that have legal consequences or a similar effect (e.g., refusal to provide a service) on an individual and are made fully automatically (but even if applied by a human), including on the basis of profiling (Article 22 GDPR), the individual must be informed. The policy regarding those decisions and what lies behind the policy, or what effect this might have on the individual, have to be explained. The Article 29 Working Party Guidelines state that at the same time it is not possible to show only one side of the story (i.e., not only benefits but also risks).

We discuss automated decision-making in a specific chapter below.

The notification obligation regarding such a broad range of issues as those provided for in the GDPR may lead to practical and technical difficulties. This is due to the fact that it is simply not clear how and when the data subject should be provided with the complete set of information required so that on the one hand it is possible to demonstrate that this obligation has been complied with and that on the other it fulfils its fundamental task, which is to truly give individuals information about the processing of their data. This is why it is important to know, and have established in the company, by way of the appropriate procedures, who, when, and by what means provides information about data processing.

When data are obtained from an individual, the individual has to be informed at the time the data are obtained. In view of the volume of information to be provided, doing so by telephone may be a problem. This is discussed further in the section on availability.

When data are obtained from other sources, an individual has to be informed as soon as possible: within one month or at the moment of the first contact, or when the data are disclosed to the recipient. Read literally, the provision suggests that the individual also has to be informed at once when the processor is provided with data, without waiting until the end of the one-month time limit. However, according to functional logic, a recipient referred to in Article 14(3)(c) GDPR is not a processor. Otherwise, any organisation which outsources their IT functions would have to inform immediately. Anyway, one month is not a long time anyway and so perhaps the problem is not such a practical one.

Where specific data covered by a notification obligation will change or have changed, the Article 29 Working Party states that an update is required. Active methods on the part of the controller (email, pop-up windows, banners, etc.) are preferable.

Even if we do not know the identity of persons whose data we process, we should provide those persons with PIO, if this is possible. Situations of this kind do arise, for example processing data concerning traffic on a website, closed-circuit television, purchase of a pseudonymised marketing database from an entity that holds these contact details, geolocation, tracking, and geo-targeting in large-scale stores and elsewhere. The processing of ‘unidentified’ data is discussed in greater detail separately.

Information must be provided in legible fashion. It is better to address the data subject on first-name terms in writing because this form is shorter and involves the least options. When speaking, however, more formal register is advised. Instead of ‘the controller/the company’ it is possible to write ‘we’. The form used should be assertive and simple language, without legalese. From the point of view of legibility, providing information verbally is not the optimal solution. The ‘Average Joe Test’ can be applied (this is also recommended by the Article 29 Working Party).

A controller whose product or service is intended for children or popular among children faces a particular challenge. In its guidelines on transparency, the Article 29 Working Party states that it is not only controllers who have a product range aimed at children but also those who should be aware that their products or services are used by children in particular (e.g., a social networking site for brief film clips that disappear) that have an obligation to adapt a message to make it suitable for children. The same guidelines also state that the language in the UN Convention on the rights of the child in child-friendly language can be used. In its guidelines on consent, the Article 29 Working Party interprets Article 8 GDPR more narrowly, citing the controller’s intent (that its website is not intentionally aimed at children, because the content is for adults, as it does not envisage revenue from children), but the same guidelines mention an age limit of 18, indicating that the architect of that section did not read, or read only superficially and quickly, Article 8 GDPR, as the age limit given in Article 8 is 16, not 18.

Where a product or service is aimed at or is popular among children, according to the Article 29 Working Party, a controller is required to ensure that messages are in a medium suitable for a child’s level of perception. In practice, it may prove difficult to formulate a single version of notification clauses for both children and adults and devise a method for the correct selection of the ‘clause’. This is a challenge faced, for example, by social networking sites and providers of content on demand.

Information must be available.

It should be easy for an individual to notice information and reach for that information. The information must be placed in full view of the data subject (but not necessarily at once in its entirety) and in such a manner that it is not combined with other messages, for example marketing content. The Article 29 Working Party stated that a full set of information on a website may be no more than two clicks away from the home page and that the home page must contain a noticeable link.

If data is obtained by telephone, in line with the ‘layered approach’ we see no reason why an email cannot be sent during the conversation containing all of the information, or why a text message or other message cannot be sent containing a link to the full set of information, provided that a data controller starts with telling why they are calling and identifies themselves, if the individual consents to use of that solution. An individual cannot be denied the provision of required information orally, but leaving an individual with only this means of communication when executing the full information obligation would be counterproductive. Some organisations decided to make the whole information obligation their welcome message. This should be forbidden due to being a form of emotional abuse and brief imprisonment. Or, to be specific, it is against the requirement of facilitating the execution of data subject’s rights (Article 12(2) GDPR). In reality such practice is intended to discourage clients and other interested parties from disturbing a data controller.

In line with the ‘layered approach’, Transparency Guidelines state that full information can be provided, for example, in a product user manual containing personal data, especially if it has a small screen or no screen (e.g., a patient’s armband) or by posting a QR code or links to websites, etc., where there are no other options.

Information about the purposes of data processing, for example, must be specific. It is not sufficient to say that ‘we use your data to develop new products, optimise services, for analyses, and to offer personalised services and products’ (examples from the Transparency Guidelines). It has to be stated specifically for what purpose the data will be processed.

A more detailed describing what we are going to do with the data may sometimes be complicated, especially that it requires different organisational units to communicate with those responsible for privacy and data protection.

Data subjects do not have to be informed of the processing elements required under the GDPR in the following cases:

#2.1 Preliminary Remarks

#2.2 Scope of Information

#2.2.1 Data Obtained Directly from an Individual

Basic information:

Information about the data subject’s rights, i.e.:

Information about whether provision of data is:

#2.2.2 Data Not Obtained Directly from an Individual

#2.2.3 Change of Purpose

#2.2.4 Right of Access

#2.3 Details of the Information

#2.3.1 Legal Basis

#2.3.2 Categories of Recipient and Recipients

#2.3.3 Data Export

#2.3.4 Profiling? No, Making Automated Decisions Having Legal or Similar Effect

#2.4 When to Notify and by What Means

#2.4.1 When to Notify

#2.4.1.1 The Moment Data Are Obtained from an Individual

#2.4.1.2 Within One Month: Indirect Collection of Data

#2.4.1.3 Updating Information

#2.4.1.4 Informing Unidentified Persons (Article 11(2) GDPR)

#2.4.2 How to Notify

#2.4.2.1 Transparency

#2.4.2.2 Availability

#2.4.2.3 Specificity

#2.5 Exceptions to the Information Obligation (When Not to Inform about Processing)