{"id":524,"date":"2019-08-28T07:04:55","date_gmt":"2019-08-28T07:04:55","guid":{"rendered":"http:\/\/www.dataprotectionconsultant.it\/EN\/?p=524"},"modified":"2020-05-26T07:55:58","modified_gmt":"2020-05-26T07:55:58","slug":"obligations-of-information-to-the-data-subject-full","status":"publish","type":"post","link":"https:\/\/www.dataprotectionconsultant.it\/EN\/obligations-of-information-to-the-data-subject-full\/","title":{"rendered":"Obligations of information to the data subject – learn more"},"content":{"rendered":"

\"\"<\/a>\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

Obligations of information to the data subject\u00a0<\/strong><\/span><\/p>\n

Obligations of information to the data subject – information ex arts. 13-14, GDPR<\/strong><\/span><\/p>\n

The main aim of the GDPR is to protect the rights and fundamental freedoms of natural persons. So, it is no wonder that the controller shall be required to describe to data subjects the features of the processing of their personal data. The principles of fair and transparent processing<\/a><\/span><\/span> require that the data subject shall be informed of the existence of the processing activity and its purposes. The controller shall provide any other information to the data subject to ensure that data processing is carried out fairly and with transparency and give the data subject a meaningful overview of the intended processing.<\/strong><\/span><\/p>\n

Data subjects shall exactly know the details of data processing and be aware of its context and circumstances: in such a manner, they shall be in a position to decide whether provide their personal data. Data subjects shall also be informed whether they are obliged to provide their data and of the consequences, where they do not provide such data.<\/strong><\/span><\/p>\n

Needless to say, information shall specify the rights of data subjects<\/a><\/span><\/span> and how to exercise them, including the right to lodge a complaint<\/a><\/span> with the supervisory authority.<\/strong><\/span><\/p>\n

This obligation is not new, being prescribed by the former legislation in force before the GDPR but further information on processing are to be added. <\/strong><\/span><\/p>\n

There is still a distinction between where data are provided by the data subject and where they have not been obtained from the data subject.<\/strong><\/span><\/p>\n

Information to be provided where personal data are collected from the data subject<\/strong><\/span><\/p>\n

It is the most common case and takes place when the controller collects data from the data subject by paper and electronic forms: data subjects shall provide the controller with their data. Here are some examples: data collection to sign up to a service, to place an order, to submit employment application, to request information about the controller\u2019s business activity.<\/strong><\/span><\/p>\n

Information to be provided shall not be generic and free choice, but the controller shall specify the elements required by art. 13, GDPR.<\/strong><\/span><\/p>\n

As a rule of thumb, where data are collected directly from the data subject, information shall be provided \u00abat the time when data are collected<\/em>\u00bb, not forgetting to inform the data subject if the controller intends to process data for other purposes than the ones for which data are collected. These purposes shall be indicated \u00abprior to that further processing<\/em>\u00bb. It is a good practice that all purposes of the intended processing activities shall be specified when collecting data. There may then be a residual condition which obliges the controller to inform the data subject about new purposes of processing adding any relevant information on these new purposes.<\/strong><\/span><\/p>\n

If data are collected from the data subject, the controller shall provide the data subject with all of the following information. Here are also some examples to better understand this obligation:<\/strong><\/span><\/p>\n

a. the identity and the contact details of the controller and, where applicable, of the controller’s representative<\/a><\/span><\/span>.<\/span><\/span> Identity and contact details of the representative shall be specified when the processing of personal data of data subjects who are in the European Union is carried out by a controller which is not established in the European Union and such processing relates to the offer of goods and services to such data subjects in the European Union or when the processing relates to the monitoring of data subjects\u2019 behaviour as far as it takes place in the European Union<\/strong><\/span><\/p>\n

b. the contact details of the Data Protection Officer<\/a><\/span>, where applicable<\/strong><\/span><\/p>\n

c. the purposes of the processing as well as the legal basis for the processing<\/span><\/span><\/a>. For instance, when data are processed to perform an order (purpose), the legal basis is the execution of contractual obligations<\/strong><\/span><\/p>\n

d. where the processing is based on the legitimate interest<\/a><\/span>, the legitimate interests pursued by the controller or by a third party: the legitimate interest shall be specified. It may be the establishment, the exercise or the defence of legal claims of the controller or of a third party<\/strong><\/span><\/p>\n

e. the recipients<\/a><\/span><\/span> or categories of recipients of the personal data, if any: for instance, if data shall be communicated to institutional bodies, the controller shall specify such bodies or the categories of bodies which are the recipients of data <\/strong><\/span><\/p>\n

f. where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation<\/a><\/span> and the safeguards which allow such transfer: for instance, when data are transferred to a processor in Chile for telemarketing activities, the safeguards may be the standard data protection clauses adopted by the European Commission <\/strong><\/span><\/p>\n

g. the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period. If data shall be processed for tax obligations purposes, the period of storage is 10 years in Italy according to the legislation on tax obligations<\/strong><\/span><\/p>\n

h. the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability: these are the fundamental rights<\/a><\/span> which allow the data subject to control data processing context and to make decision on the matter even after their provision <\/strong><\/span><\/p>\n

i. where the processing is based on consent<\/a>,<\/span><\/span> the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. At any time and free of charge, the data subject can withdraw consent which has been previously expressed. Processing activities carried out on the basis of the consent given before its withdrawal remain lawful<\/strong><\/span><\/p>\n

j. the right to lodge a complaint<\/a><\/span><\/span> with a supervisory authority: it is a new right of immediate applicability: data subjects can lodge a complaint with a supervisory authority to enforce their data protection rights (authority of the European Union country where the data subject lives, works or where the alleged infringement has taken place) <\/strong><\/span><\/p>\n

k. whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide personal data and of the possible consequences of failure to provide such data: for instance, if in the context of an order, information on job should not be requested as mandatory and if not provided, the person has the right to have the order fulfilled. Such information is not necessary to perform the order<\/strong><\/span><\/p>\n

l. the existence of automated decision-making, including profiling<\/a><\/span> and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. An example relating to profiling cookies on a website for marketing activities purposes clarifies the point: the user shall be aware of such processing in order to give or deny consent to such profiling purpose.<\/strong><\/span><\/p>\n

As the previous legislation, the GDPR provides that the obligation of information does not apply if the data subject has already such information. Any amendment shall be provided to the data subject.<\/strong><\/span><\/p>\n

Information to be provided where personal data have not been obtained from the data subject<\/strong><\/span><\/p>\n

Data may also be provided by or obtained from third parties: it is the case where data are not directly provided by the data subject, but by another natural or legal person. For instance, a customer can specify that the goods ordered shall be delivered to a neighbour or a donor can provide first and last name and contacts (e.g.: e-mail) of a friend who may be interested to donate to a specific not-for-profit organisation.<\/strong><\/span><\/p>\n

Where data are not obtained directly from the data subject, the controller shall provide the data subject with information:<\/strong><\/span><\/p>\n

a. within a reasonable period after obtaining the personal data, but \u00abat the latest within one month<\/em>\u00bb<\/strong><\/span><\/p>\n

b. if the personal data are to be used for communication with the data subject, \u00abat the latest at the time of the first communication to that data subject<\/em>\u00bb; or<\/strong><\/span><\/p>\n

c. if a disclosure to another recipient<\/a><\/span><\/span> is envisaged, \u00abat the latest when data are first disclosed<\/em>\u00bb.<\/strong><\/span><\/p>\n

Information to be provided is:<\/strong><\/span><\/p>\n

a. the identity and the contact details of the controller and, where applicable, of the controller’s representative<\/a><\/span><\/span><\/strong><\/span><\/p>\n

b. the contact details of the Data Protection Officer<\/a>, where applicable<\/strong><\/span><\/p>\n

c. the purposes of the processing for which the personal data are intended as well as the legal basis for the processing<\/a><\/span><\/span><\/strong><\/span><\/p>\n

d. the categories of personal data <\/strong><\/span><\/p>\n

e. the recipients<\/a><\/span><\/span> or categories of recipients of the personal data, if any <\/strong><\/span><\/p>\n

f. where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation<\/a><\/span><\/span> and the safeguards which allow such transfer<\/strong><\/span><\/p>\n

g. the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period<\/strong><\/span><\/p>\n

h. where the processing is based on the legitimate interest<\/a><\/span><\/span>, the legitimate interests pursued by the controller or by a third party<\/strong><\/span><\/p>\n

i. the existence of the right to request access to and rectification or erasure of data or restriction of processing and to object to processing as well as the right to data portability (rights of data subjects<\/a><\/span><\/span>)<\/strong><\/span><\/p>\n

j. where processing is based on consent<\/a>,<\/span><\/span> the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal<\/strong><\/span><\/p>\n

k. the right to lodge a complaint<\/a><\/span><\/span> with a supervisory authority<\/strong><\/span><\/p>\n

l. from which source the personal data originate, and if applicable, whether data came from publicly accessible sources<\/strong><\/span><\/p>\n

m. the existence of automated decision-making, including profiling<\/a><\/span><\/span> and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.<\/strong><\/span><\/p>\n

Examples given in the previous paragraph can be useful, where appropriate considering the context of the collection, also for this case.<\/strong><\/span><\/p>\n

It should be noted that if data are not collected from the data subject, information shall contain also the categories of data and the source from which they come. When it is not possible to specify the source, because data have been collected from several sources, general information shall be provided. <\/strong><\/span><\/p>\n

As the previous legislation, the GDPR provides that the obligation of information does not apply if the data subject has already such information. Any amendment shall be provided to the data subject. <\/strong><\/span><\/p>\n

How to provide information<\/strong><\/span><\/p>\n

Information shall be provided in a clear, plain language, easily accessible and concisely, and, where appropriate, visualisation shall be used<\/span>. Information shall be provided in writing<\/span> but also orally<\/span>, such as when data are collected via phone, concisely, and full information is to be provided by redirecting the data subject to a website or by using other instruments which allow the data subject to know all the elements required by the GDPR. Such information could be provided in electronic form<\/span>, for example, when addressed to the public, on a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purposes personal data are being collected (such as in the case of on-line advertising).<\/strong><\/span><\/p>\n

The GDPR makes provisions for the use of standardised icons to be provided in combination with such information in an easy, legible, intelligible manner and, if used on-line, machine-readable. The Commission shall issue delegated acts to define these icons and the procedures to provide them.<\/strong><\/span><\/p>\n

 <\/p>\n

To learn more, read FAQs<\/a><\/span><\/span> or contact me<\/a><\/span><\/span>.<\/strong><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    Obligations of information to the data subject\u00a0 Obligations of information to the data subject – information ex arts. 13-14, GDPR The main aim of the GDPR is to protect the rights and fundamental freedoms of natural persons. So, it is no wonder that the controller shall be required to describe to data subjects … <\/p>\n

Continue reading “Obligations of information to the data subject – learn more”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/524"}],"collection":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/comments?post=524"}],"version-history":[{"count":18,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/524\/revisions"}],"predecessor-version":[{"id":527,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/524\/revisions\/527"}],"wp:attachment":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/media?parent=524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/categories?post=524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/tags?post=524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}