The right to obtain information on the processing of personal data

Data subjects have the right to be informed of the collection and processing of their personal data. The processing of personal data shall be done in a transparent manner.

Data subjects have to be informed of, among other things,

• the name and the contact information of the controller
• the purposes for which the data is being processed
• the legal basis for the processing of data
• the processing times of the data
• to whom the data is disclosed
• the disclosing of data outside EU or EEA
•  the rights of the data subject
• the source of the data if it is not obtained directly from the data subject.

Read more about the notification practices

The information on processing must be provided in a concise, transparent, intelligible and accessible from and be presented in clear and plain language. This is particularly important if the information is addressed specifically to children.

Notification implementation time

• When data are collected from the data subject: at the time when the data are collected.
• When data are obtained from elsewhere than the data subject: within a reasonable period of time, yet after one month from the receipt of the data at the latest.
• When data used in communications with the data subject are obtained from elsewhere than the data subject: when the data subject is contacted for the first time at the latest.
• When data intended to be disclosed to another recipient are obtained from elsewhere than the data subject: when the data are disclosed for the first time at the latest.

Notification is not necessary in the following cases

• When the data subject has already received the information in question.
• Not carrying out notification is necessary due to State security, defence, public order and security, the prevention or investigation of criminal offences or a supervisory duty related to taxation or public finances.
• When the data have been received from elsewhere than the data subject and notification proves impossible or would require unreasonable effort.
  • Especially if the data are processed for archiving in the public interest or for scientific and historical purposes, for statistical purposes or notification would prevent the achievement of the purposes of the processing or would considerably hamper processing.
    • The controller must implement appropriate measures to protect the data subject's rights and freedoms and legitimate interests, at least by making information on the processing of personal data publicly available.
  • The collection or disclosure of data is expressly provided for in legislation to which the controller is subject and which sets out appropriate measures to protect the data subject's legitimate interests.
  • The data of which the data subject should be notified are subject to a non-disclosure obligation prescribed in law.
  • Notification would cause material loss or impediment to the data subject and the data saved are not used for decision-making concerning the data subject.
    • The controller must take appropriate measures to protect the data subject's rights, at least by making information on the processing of personal data publicly available, unless this compromises the purpose of the limitation concerning the notification obligation.

Read more:
GDPR: Articles 12, 13 and 14 (EUR-Lex)