Duty to inform and right of access to personal data

Art. 13 GDPR, Art. 14 GDPR and Art. 15 GDPR

If someone processes our personal data, they are obliged to inform us about a number of things before the data is collected: 

• Who collects the data? Who is the controller and how can I contact them?
  
• For what purposes and on what legal basis is the data collected?
• Who has access to the data?
• If data is transferred to a third country: Information about the applicable data protection safeguards to protect the data.
• How long will the data be stored? When will it be deleted?
• Information on our rights (right of access, rectification, restriction of processing, data portability and the right to object)
• Reference to our right to lodge a complaint with a supervisory authority
• Explanation of whether the provision of the data is mandatory for us for any reason and the possible consequences of not providing it.
• In the case of data collection with the aim of automated decision-making or profiling, an explanation of the logic involved and a description of the scope and impact of the processing must also be provided.

This is a long list of information that the controller must provide. This is the reason why the data protection notices we receive are correspondingly extensive. The obligation to inform data subjects is mandatory. It is also not dependent on whether processing is lawful, as this can be assumed. 

Data protection notices can be found online on websites, for example, or handed out on paper when visiting a doctor. In both examples, the information must be provided BEFORE the data is processed.

Task

Take some time to think about the last time your personal data was processed. Can you remember when you were given this information? Have you read the information?

Source: Jan on Pixabay

The right to information 

In addition to the controller's obligation to provide information, we as data subjects also have a specific right to information. We must receive information about whether and how our personal data is being processed. The controller is obliged to provide us with this information within one month of receiving the request at the latest.

Transparency and modalities

Art. 12 GDPR

All information about our personal data and its processing must be provided to us "in a concise, transparent, intelligible and easily accessible form, using clear and plain language". This applies in particular to information aimed specifically at children. 

The information must be provided immediately, but at the latest within one month of our request. The information must also be provided to us free of charge.

Source: bookdragon on Pixabay