Article 29 Working Party - Guidelines on transparency under Regulation 2016/679

ARTICLE 29 DATA PROTECTION WORKING PARTY This Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body on data protection and privacy. Its tasks are descr bed in Article 30 of Directive 95/46/EC and Article 15 of Directive 2002/58/EC. The secretariat is provided by Directorate C (Fundamental Rights and Union Citizenship) of the Europe an Commission, Directorate General Justice, B - 1049 Brussels, Belgium, Office No MO - 59 02/013. 01 Article 29 Working Party Guidelines on transparency under Regulation 2016/679 Adopted on 29 November 2017 As last Revised and Adopted on 11 April 2018 THE WORKING PARTY ON THE PROTECTION OF INDIVIDUALS WITH REGARD TO THE PROCESSING OF PERSONAL DATA set up by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995, having regard to Articles 29 and 30 thereof, having rega rd to its Rules of Procedure, HAS ADOPTED THE PRESENT GUIDELINES : ARTICLE 29 DATA PROTECTION WORKING PARTY Page 2 of 40 ARTICLE 29 DATA PROTECTION WORKING PARTY Page 4 of 40 Introduction 1.

These guidelines provide practical guidance and interpretative assistance from the Article 29 Working Party (WP29) on the new obligation of transparency concerning the processing of personal data under t he General Data Protection Regulation 1 (the “ GDPR ”). Transparency is an overarching obligation under the GDPR applying to three central areas : (1) the provision of information to data subjects related to fair processing; (2) how data controllers communicate with data subjects in relation to their rights under the GDPR; and (3) how data controllers facilitate the exercise by data subjects of their rights 2 . Insofar as compliance with transparency is required in relation to data processing under Directive (EU) 2016/680 3 , these guidelines also apply to the in terpretation of that principle. 4 These guideline s are, like all WP29 guidelines, intended to be generally applica ble and relevant to controllers irrespective of the sectoral, industry or regulatory specifications particular to any given data controller.

As such, these guidelines cannot address the nuances and many variables which may arise in the context of the transparency obligations of a specific sector, industry or regulated area. However , these guidelines are intended to enable controllers to understand , at a high level, WP29’s interpretation of what the transparency obligations entail in practice and to indicate the approach which WP29 considers controllers should take to being transparent while embedding fair ness and accountability into their transparency measures . 2. Transparency is a long established feature of the law of the EU 5 . It is about engendering trust in the processes which affect the citizen by enabling them to understand, and if necessary, challenge those processes. It is also an ex pression of the principle of fairness in relation to the 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

2 These g uidelines set out general principles in relation to the exercise of data subjects’ rights rather than considering specific modalities for each of the individual data subject rights under the GDPR. 3 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA 4 While transparency is not one of the principles relating to processing of personal data set out in Article 4 of Directive (EU ) 2016/680, Reci tal 26 states that any processing of personal data must be “lawful, fair and transparent” in relation to the natural persons concerned.

5 Article 1 of the TEU refers to decisions being taken “ as openly as possible and as close to the citizen as possible ”; Article 11(2) states that “ The institutions shall maintain an open, transparent and regular dialogue with representative associations and civil society”; and Article 15 of the TFEU refers amongst other things to citizens of the Union having a right of access to documents of Union institutions, bodies, offices and agencies and the requirements of those Union institutions, bodies, offices and agencies to ens ure that their proceedings are transparent. Page 5 of 40 processing of personal data expressed in Article 8 of the Charter of Fundamental Rights of the European Union. U nder the GDPR (Article 5(1)(a) 6 ), in addition to the requirement s that data must be processed lawfully and fairly, transparency is now included as a fundamental aspect of these principle s . 7 Transparency is intrinsically linked to fairness and the new principle of accountability under the GDPR.

2 that the controller must always be able to demonstrate that personal data are processed in a transparent manner in relation to the data subject. 8 Connected to this, the accountability principle requires transparency of processing operations in orde r that data controllers are able to demonstrate compliance with their obligations under the GDPR 9 . 3. In accordance with Recital 171 of the GDPR, where processing is already under way prior to 25 May 2018, a data controller should ensure that it is complian t with its transparency obligations as of 25 May 2018 (along with all other obligations under the GDPR). This means that prior to 25 May 2018, data controllers should revisit all information provided to data subjects on processing of their person al data (f or example in privacy statements / notices etc. ) to ensure that they adhere to the requirements in relation to transparency which are discussed in these guidelines.

Where changes or additions are made to such information, controllers should make it clear to data subjects that these changes have been effected in order to comply with the GDPR. g. on their website). However, i f the changes or additions are material or substantive, then in line with paragraph s 29 to 32 below , such changes should be actively brought to the attention of the data subject. 4. Transparency, when adhered to by data controllers, empowers data subjects to hold data controllers and processors accountable and to exercise control over their personal data by, for example , providing or withdrawing inf ormed consent and actioning their data subject rights 10 . The concept of transparency in the GDPR is user - centric rather than legalistic and is realised by way of specific practical requirements on data controllers and processors in a number of articles. The practical (information) requirements are outlined in Articles 12 - 14 of the GDPR.

However, the quality, accessibility and comprehensibility of the information is as important as the actual content of the transparency information, which must be provided t o data subjects . 6 “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”. 7 In Directive 95/46/EC, transparency was only alluded to in Recital 38 by way of a requirement f or processing of data to be fair, but not expressly referenced in the equivalent Article 6(1)(a). 1) under the principle of accountability. 1. 10 See , for example , the Opinion of Advocate General Cruz Villalon (9 July 2015) in the Bara case (Case C - 201/14) at paragraph 74: “ the requirement to inform the data subjects about the processing of their personal data, which guarantees transpare ncy of all processing, is all the more important since it affects the exercise by the data subjects of their right of access to the data being processed, referred to in Article 12 of Directive 95/46, and their right to object to the processing of those dat a, set out in Article 14 of that directive”.

Page 6 of 40 5. The transparency requirements in the GDPR apply irrespective of the legal basis for processing and throughout the life cycle of processing. e. e. when communicating with data subjects about their rights; and  at specific points while processing is ongoing, for example when data breaches occur or in the case of material changes to the processing. The meaning of transparency 6. Transparency is no t defined in the GDPR. Recital 39 of the GDPR is informative as to the meaning and effect of the principle of transparency in the context of data processing: “It should be transparent to natural persons that personal data concerning them are collected, us ed, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and eas y to understand, and that clear and plain language be used.

That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed…” Elements of transparency under the GDPR 7. The key articles in relation to transparency in the GDPR , as they apply to the rights of the data subject, are found in Chapter III (Rights of the Data Subject). Article 12 sets out the general rules which apply to: the provision of information to data subjects (under Articles 13 - 14); communications with data subjects concerning the exercise of th eir rights (under Articles 15 - 22); and communications in relation to data breaches (Article 34). 5). “Concise, transparent, intelligible and easily accessible” 8.

The requirement that the provision of information to, and communication with, data subjects is done in a “concise and transparent” manner means that data controllers should present the information/ communication efficiently and succinctly in order to avoid information fatigue. This i nformation should be clearly differentiated from other non - privacy related information such as contractual provisions or general terms of use . In an on line context, the use of a layered privacy statement / notice will enable a data subject to navigate to the particular section of the privacy statement / notice which they want to immediately access rather than having to scr oll through large amounts of text searching for particular issues. 9. The requirement that information is “intelligible” means that it should be understood by an average member of the intended audience. Intelligibility is closely linked to the requirement to use clear and plain language.

An accountable data controller will have knowledge about the people they collect information about and it can use this knowledge to determine what that audience would likely understand. Fo r example, a controller collecting th e personal data of working professionals can assume its audience has a higher level of understanding than a controller that obtains the personal data of children. If controllers are uncertain about the level of intelligibility and transparency of the infor mation and effectiveness of user interfaces/ notices/ policies etc. , they can test these, for example, through mechanisms such as user panels , readability testing, formal and informal interactions and dialogue with industry groups, consumer advocacy groups and regulatory bodies , where appropriate , amongst other things . 10. A central consideration of the principle of transparency outlined in these provisions is that the data subject should be able to determine in advance what the scope and consequences of the p rocessing entails and that they should not be taken by surprise at a later point about the ways in which their personal data has been used .

1 of the GDPR and indeed is linked to Recital 39 which states that “[n]atural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data. ” I n particular , for complex , technical or unexpected data processing, WP2 9 ’s position is that , as well as provid ing the prescribed information under Articles 13 and 14 (dealt with later in these guidelines) , controllers should also separately spell out in unambiguous language what the most important consequences of the processing will be: in other words , what kind of effect will the specific processi ng described in a privacy statement/ notice actually have on a data subject ? In accordance with the principle of accountability and in line with Recital 39, data cont rollers should assess whether there are particular risks for natural persons involved in this type of processing which should be brought to the attention of data subjects.

This can help to provide an overview of the types of processing that could have the highest impact on the fundamental rights and freedoms of data subjects in relation to the protection of their personal data. Page 8 of 40 11. The “easily accessible” element means that the data subject should not have to seek out the information; it should be immediately apparent to them where and how this information can be accessed, for example by providing it directly to them, by linking them to it, by clearly signposting it or as an answer to a natural language question (for example in an on line layered privacy statem ent / notice , in FAQs, by way of contextual pop - ups which activate when a data subject fills in an online form, or in an interactive digital context through a chatbot interface , etc. These mechanisms are further considered below, including at paragraphs 33 to 40 ). Example Every organisation that maintains a website should publish a privacy statement / notice on the website.

A direct link to this privacy statement / notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice” ). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible. For apps, the necessary information s hould also be made available from an online store prior to download. Once the app is installed, the information still needs to be easily accessible from within the app. g. by including a “Privacy”/ “Data Protection” option in the menu functionality of the app) . Additionally, t he privacy information in question should be specific to the particular app and should not merely be the generic privacy policy of the company that owns the app or makes it available to the public. WP29 recommends as a best practice that at the point of collection of the person al data in an online context a link to the privacy statement/ notice is provided or that this information is made available on the same page on which the personal data is collected.

“Clear and plain language” 12. With written information (and where written information is delivered orally, or by audio/ audiovisual methods, including for vision - impaired data subjects), best practices for clear writing should be followed. 11 A similar language requirement (for “plain, intelligible language”) has previously been used by the EU legislator 12 and is also explicitly referred to in the context of consent in Recital 42 of the GDPR 13 . The requirement for clear and plain language means that information should be provided in as simple a manner as possible, avoiding complex sentence and language stru ctures. eu/en/publication - detail/ - /publication/c2dab20c - 0414 - 408d - 87b5 - dd3c6e5dd9a5. 12 Article 5 of Council Direc tive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts 13 Recital 42 states that a declaration of consent pre - formulated by a data controller should be provided in an intelligible and easily accessible form, using clear and plain language and it sh ould not contain unfair terms.

Page 9 of 40 interpretations. In particular the purposes of, and legal basis for, processing the personal data should be clea r. Poor Practice Example s The following phrases are not sufficiently clear as to the purposes of processing:  “We may use your personal data to develop new services” (as it is unclear what the “ services ” are or how the data will help develop them);  “We may use your personal data for research purposes (as it is unclear what kind of “ research ” this refers to); and  “We may use your personal data to offer personalised services” (as it is unclear what the “ personalisation ” entails). Good Practice Examp les 14  “We will retain your shopping history and use details of the products you have previously purchased to make suggestions to you for other products which we believe you will also be interested in ” (it is clear that what types of data will be processed, that the data subject will be subject to targeted advertisements for products and that their data will be used to enable this);  “We will retain and evaluate information on your recent visits to our website and how you move around different sec tions of our website for analytics purposes to understand how people use our website so that we can make it more intuitive” (it is clear what type of data will be processed and the type of analysis which the controller is going to undertake); and  “We will keep a record of the articles on our website that you have clicked on and use that information to target advertising on this website to you that is relevant to your interests , which we have identified based on articles you have read ” (it is clear what the personalisation entails and how the interests attributed to the data subject have been identified ).

13. Language qualifiers such as “may”, “might”, “some”, “often” and “possible” should also be avoided . W here data controllers opt to use indefinite language , they should be able , in accordance with the principle of accountability, to demonstrate why the use of such language could not be avoided and how it does not undermine the fairness of processing . Paragraphs and sentences should be well structured, utilis ing bullets and indents to signal hierarchical 14 The requirement for transparency exists entirely independently of the requirement upon data controllers to ensure that there is an appropriate legal basis for the processing under Article 6. Page 10 of 40 relationships. Writing should be in the active instead of the passive form and e xcess nouns should be avoided. The information provided to a data subject should not contain overly legalistic, technical or spec ialist language or terminology.

Where the information is translated into one or more other languages, the data controller should ensure that all the translations are accurate and that the phraseology and syntax makes sense in the second language(s) so that the translated text does not have to be deciphered or re - interpreted. ) Providing information to children and other vulnerable people 14. Where a data c ontroller is targeting children 16 or is , or should be, aware that their goods/ services are particularly utilised by children ( including where the controller is relying on the consent of the child) 17 , it should ensure that the vocabulary, tone and style of the language used is appropriate to and resonates with children so that the child addressee of the information recognises that the message/ information is being directed at them. 18 A useful example of child - centred language used as an alternative to the original legal language can be found in the “UN Convention on the Rights of the Child in Child Friendly Language”.

19 15. WP29’s position is that transparency is a free - standing right which applies as much to children as it does to adults. WP29 emphasises in particular that children do not lose their rights as data subjects to transparency simply because consent has been given/ authorised by the holder of parental responsibility in a situation to which Artic le 8 of the GDPR applies. While such consent will , in many cases , be given or authorised on a once - off basis by the holder of parent al responsibility, a child (like any other data subject) has an ongoing right to transparency throughout the continuum of th eir engagement with a data controller. This is consistent with Article 13 of the UN Convention on the Rights of the Child which states that a child has a right to freedom of expression which includes the right to seek, receive and impart information and id eas of all kinds. 20 It is important to point out th at, while providing for consent to be given on behalf of a child when under a particular age , 21 Article 8 does not provide for transparency measures to be directed at the holder of paren tal responsibility who 15 For example, where the controller operates a website in the language in question and/or offers specific country options and/or facilitates the payment for goods or services in the currency of a particular member state then these may be indicative of a dat a controller targeting data subjects of a particular member state.

16 The term “child” is not defined under the GDPR, however WP29 recognises that, in accordance with the UN Convention on the Rights of the Child, which all EU Member States have ratified, a child is a person under the age of 18 years. e. 1 of the GDPR Member State national law has set the age of consent at a specific age between 13 and 16 years for children to consent t o an offer for the provision of information society services, children who meet that national age of consent) . 18 Recital 38 states that “Children merit special protection with regard to their personal data as they may be less aware of the risks, consequen ces and safeguards concerned and their rights in relation to the processing of personal data”. Recital 58 states that “ Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand”.

” 21 See footnote 1 7 above. Page 11 of 40 gives such consent. 1 ( supported by Recitals 38 and 58) to ensure that where they ta rget children or are aware that their goods or services are particularly utilised by children of a literate age , that any information and communication should be conveyed in clear and plain language or in a medium that children can easily understand. For t he avoidance of doubt however, WP29 recognises that with very young or pre - literate children, transparency measures may also be addressed to holders of parental responsibility given that such children will , in most cases, be unlikely to understand even the most basic written or non - written messages concerning transparency. 16. Equally, if a data controller is aware that their goods/ services are availed of by (or targeted at) other vulnerable members of society, including people with disabilities or people who may have difficulties accessing information, the vulnerabilities of such data subjects should be taken into account by the data controller in its assessment of how to ensure that it complies with its transparency obligations in relation to such data subje ct s .

22 This relates to the need for a data controller to assess its audience’s likely level of understanding , as discussed above at paragraph 9 . “In writing or by other means” 17. 1, the default position for the provision of information to, or communications with, data subjects is that the information is in writing . 7 also provides for information to be provided in combination with standardised icons and this issue is con sidered in the section on visualisation tools at paragraphs 4 9 to 53 ). However, the GDPR also allows for other, unspecified “means” including electronic means to be used. WP29’s position with regard to written electronic means is that where a data control ler maintains ( or operates, in part or in full, through ) a website, WP29 recommends the use of layered privacy statement s / notices , which allow website visitors to navigate to particular aspects of the relevant privacy statement / notice that are of most interest to them (see mo re on layered privacy statements/ notices at paragraph 3 5 to 37 ) .

24 However, the entirety of the information addressed to data subjects should also be available to them in one single place or one complete document (wheth er in a digital or paper format) which can be easily accessed by a data subject should they wish to consult the entirety of the information addressed to them. Importantly, the use of a layered approach is not confined only to written electronic means for p roviding information to data subjects. As discussed at paragraphs 35 to 36 and 38 below, a layered approach to the provision of information to data subjects may also be utilised by employing a combination of methods to ensure transparency in relation to processing. 22 For example, the UN Convention on the Rights of Persons with Disabilities requires that appropriate forms of assistance and support are provided to persons with disabilities to ensure their access to information. 1 refers to “language” and states that the information shall be provided in writing, or by other means, including, where appropriate, by electronic means.

24 The WP29’s recogni tion of the benefits of layered notices has already been noted in Opinion 10/2004 on More Harmonised Information Provisions and Opinion 02/2013 on apps on smart devices. Page 12 of 40 18. Of course, the use of digital layered privacy statements / notices is not the only written electronic means that can be deployed by controllers. Other electronic means include “just - in - time” context ual po p - up notices, 3D touch or hover - over notices, and privacy dashboards. N on - written electronic means which may be used in addition to a layered privacy statement / notice might include videos and smartphone or IoT voice alerts. 25 “Other means”, which are not n ecessarily electronic, might include, for example, cartoons, infographics or flowcharts. g. these might be comics/ cartoons, pictograms, animations , etc. amongst other measures). 19. e. the manner in which the data controller and data subject interact or the manner in which the data subject’s information is collected.

g. IoT devices/ smart devices) to access the website/ display such written information. e. the specific page on the website) at which the online privacy statement / notic e can be found in the hard copy instructions or in the packaging . Audio (oral) delivery of the information could also be additionally provided if the screenless device has audio capabilities. WP29 has previously made recommendations around transparency and provision of information to data subjects in its Opinion on Recent Developments in the Internet of Things 26 (such as the use of QR codes printed on internet of things objects, so that when scanned, the QR code will display the required transparency informa tion). These recommendations remain applicable under the GDPR. the information may be provided orally” 20. 1 specifically contemplates that information may be provided orally to a data subject on request, provided that their identity is proven by other means .

In other words, the means employed should be more than reliance on a mere assertion by the individual that they are a specific named person and the means should enable the controller to verify a data subject’s identity with sufficient assur ance . T he requirement to verify the identity of the data subject before providing information orally only applies to information relating to the exercise by a specific data subject of their rights under Articles 15 to 22 and 34. This precondition to the pr ovision of oral information cannot apply to the provision of general privacy information as outlined in Articles 13 and 14, since information required under Article s 13 and 14 must also be made accessible to future users/ customers (whose identity a data controller would not be in a position to verify). Hence, information to be provided under 25 These examples of electronic means are indicative only and data cont rollers may deve lop new innovative methods to comply with Article 12.

26 WP29 Opinion 8/2014 adopted on 16 September 2014 Page 13 of 40 Articles 13 and 14 may be provided by oral means without the controller requiring a data subject’s identity to be proven. 21. e. in person or by telephone) . A utomated oral information may be provided in addition to written means. Fo r example, this may apply in the context of persons who are visually impaired when interacting with information society service providers, or in the context o f screen less smart devices, as refe rred to above at paragraph 1 9 . Where a data controller has chos en to provide information to a data subject orally , or a data subject requests the provision of oral information or communications, WP29’s position is that the data controller should allow the data subject to re - listen to pre - recorded messages. This is imp erative where the request for oral information relates to visually impaired data subject s or other data subjects who may have difficulty in accessing or understanding information in written format.

The data controller should also ensure that it has a recor d of, and can demonstrate (for the purposes of complying with the accountability requirement) : (i) the request for the information by oral means , (ii) the method by which the data subject’s identity was verified (where applicable – see above at paragraph 2 0 ) and (iii) the fact that information was provided to the data subject. “Free of charge” 22. 5 , 27 data controllers cannot generally charge data subjects for the provision of information under Article s 13 and 14, or for communications and actions taken under Articles 15 - 22 (on the rights of data subjects) and Article 34 (communication of personal data breaches to data subjects) . 28 This aspect of transparency also means that any information provided und er the transparency requirements cannot be made conditional upon financial transactions, for example the payment for, or purchase of, services or goods.

29 Information to be provided to the data subject – Articles 13 & 14 Content 23. The GDPR lists the categories of information that must be provided to a data subject in relation to the processing of their personal data where it is collected from the data subject (Article 13) or obtained from another source (Article 14). 5 the controller may charge a reasonable fee where, for example, a request by a data subject in relation to the information under Article 13 and 14 or the rights under Articles 15 - 22 or Article 34 is excessive or manifestly unfounded. 3 a controller may charge a reasonable fee based on administrative costs for any further copy of the personal data which is requested by a data subject). 29 By way of illustration, if a data subject’s personal data is being collected in connection with a purchase, th e information which is required to be provided under Article 13 should be provided prior to payment being made and at the point at which the infor mation is being collected, rather than after the transaction has been concluded.

1 requires the provision of the information “at the time when the personal data are obtained”. Page 14 of 40 guidelines summarises the categories of information that must be provided under Articles 13 and 14. It also considers the nature, scope and content of these requirements. For clarity, WP29’s position is that there is no difference between the status of the information to be provided under sub - article 1 and 2 of Articles 13 and 14 respectively . All of the information across these sub - articles is of equal importance and must be provided to the data subject. “Appropriate measures” 24. As well as content, the form and manner in which the information required under Article s 13 and 14 should be provided to the data subject is also important. The notice containing such information is frequently referred to as a data protection notice, privacy notice, privacy policy, privacy statement or fair processing notice.

The GDPR does not prescribe the format or modality by which such information should be provided to the data subject but does make it clear that it is the data controller’s responsibility to take “appropriate measures” in relation to the provision of the required information for transparency purposes. This means that the data controller should take into account all of the circumstances of the d ata collection and processing when deciding upon the a ppropriate modality and format of the information provision. In particular, appropriate measures will need to be assessed in light of the product/ service user experience. This means taking account of the device used (if applicable), the nature of the user interfaces/ interactions with the data controller (the user “journey”) and the limitations that those factors entail. As noted above at paragraph 1 7 , WP29 recommends that where a data controller has an online presence, an online layered privacy statement / notice should be provided.

25. g. hall tests , or other standa rdised tests of readability or accessibility ) to seek feedback on how accessible, understandable and easy to use the proposed measure is for users. (See also further comments above on other mechanisms for carrying out user testing at paragraph 9 ). Document ing this approach should also assist data controllers with their accountability obligations by demonstrating how the tool/ approach chosen to convey the information is the most appropriate in the circumstances. Timing for provision of information 26. Articles 13 and 14 set out information which must be provided to the data subject at the commencement phase of the processing cycle 30 . Article 13 applies to the scenario where the data is collected from the data subject . T his includes personal data that: 30 Pursuant to the principles of fairness and purpose limitation , the organisation which collects the personal data from the data subject should always specify the purposes of the processing at the time of collection.

4. g. g. using automated data capturing devices or data capturing software such as cameras, network equipment, Wi - Fi tracking, RFID or other types of sensors) . Article 14 applies in the scenario where the data have not been obtained from the data subject . This includes personal data which a data controller has obtai ned from sources such as:  third par ty data controller s;  publicly available source s;  data broker s; or  o ther data subject s . 27. As regards timing of the provision of this information , providing it in a timely manner is a vital element of the transparency obligation and the obligation to process data fairly. 1 the information must be provided “at the time when personal data are obtained”. 3(a)). 3(b) , 31 which provides for a situation where the data are being used for communication with the data subject . In such a case, the information must be provided at the latest at the time of the first communication with the data subject.

If the first communication occurs prior to the one - month time limit after obtaining the personal data , then the information must be provided at the latest at the time of the first communication with the data subject notwithstanding that o ne month from the point of obtaining the data has not expired. 3(a) continues to apply , so that the Article 14 information must be p rovided to the data subject at the latest within one month after it was obtained. 3(a) but does not replace it. 3(c) 32 which provides for a situation where the data are being disclosed to another recipient (whether a third party or not) 33 . In such a case , the information must be provided at the latest at the time of the first disclosure. In this scenario, if the disclosure occurs prior to the one - month time limit, then the information must be provided at the latest at the time of that first disclosure, notwithstanding that one month from the point of obtaining the data has not expired.

3(a) again continues to apply, so that the Article 14 information must be provided to the data subject at the latest within one month after it was obtained. 28. The refore, i n any case, the maximum time limit within which Article 14 information must be provided to a data subject is one month. However, the principles of fairness and accountability under the GDPR require data controllers to always consider the reasonabl e expectations of data subjects, the effect that the processing may have on them and their ability to exercise their rights in relation to that processing , when deciding at what point to provide the Article 14 information . Accountability requires controlle rs to demonstrate the rationale for their decision and justify why the information was provided at the time it was. In practice, it may be difficult to meet these requirements when providing information at the ‘last moment’.

In this regard, Recital 39 stip ulates, amongst other things, that data subjects should be “made aware of the risks, rules, safeguards and rights in relation to the processing of personal data and how to exercise their rights in relation to such processing” . Recital 60 also refers to the requirement that the data subject be informed of the existence of the processing operation and its purposes in the context of the principles of fair and transparent processing. For all of these reasons, WP29’s position is that, wherever possible , data controllers should , in accordance with the principle of fairness, provide the information to data subjects well in advance of the stipulated time limits. Further comments on the appropriateness of the timeframe between notifying data subjects of the p rocessing operations and such processing operations actually taking effect are set out in paragraph s 30 to 31 and 48.

Changes to Article 13 and Article 14 i nformation 29. Being accountable as regards tr ansparency applies not only at the point of collection of personal data but throughout the processing life cycle, irrespective of the information or communication being conveyed. This is the case, for example, when changing the contents of existing privacy statements/ notices . The controller should adhere to t he same principles when communicating both the initial privacy statement/ notice and any s ubsequent substantive or material changes to this statement / notice . 3(a) but does not replace it. 9 defines “recipient” and clarifies that a recipient to whom personal data are disclosed does not have to be a third party. Therefore, a recipient may be a data controller, joint controller or processor. Page 17 of 40 change would be to data subjects . Changes to a privacy statement/ notice that should always be communicated to data subjects include inter alia : a change in proc essing purpose ; a change to the identity of the controller; or a change as to how data subjects can exercise their rights in relation to the processing.

Conversely, an example of changes to a privacy statement/ notice which are not considered by WP29 to be substantive or material include corrections of misspellings, or stylistic/ grammatical flaws. Since most existing customers or users will only glance over communications of changes to privacy statements/ notices , the controlle r should take all measures necessary to ensure that these changes are communicated in such a way that ensures that most recipients will actually notice them. g. g. not together with direct marketing content ), with such a communication meeting the Article 12 requirements of being concise, transparent, intelligible, easily accessible and using clear and plain language. 1(a). Further guidance in relation to the timing for notification of changes to data subjects is considered belo w at paragraph 30 to 31 . Timing of notification of changes to Article 13 and Article 14 information 30.

4 – see below at paragraph 4 5 ). However, as noted above in the context of the timing for the provision of Article 14 information , the data controller must again have regard to the fairness and accountability principle s in terms of any reasonable expectations of the data subject, or the potential impact of those changes upon the dat a subject. g. enlargement of the ca tegories of recipients or introduction of transfers to a third country) or a change which may not be f undamental in terms of the processing operation but which may be relevant to and impact upon the data subject , then that information should be provided to the data subject well in advance of the change actually taking effect and the method used to bring the changes to the da ta subject’s attention should be explicit and effective. g. to withdraw consent or to object to the processing). 31. Data controllers should ca refully consider the circumstances and context of each situation where an update to transparency information is required, including the potential impact of the changes upon the data subject and the modality used to communicate the changes, and be able to d emonstrate how the timeframe between notification of the changes and the Page 18 of 40 change taking effect satisfies the principle of fairness to the data subject.

Further, WP29’s position is that, consistent with the principle of fairness, when notifying such changes to data subjects, a data controller should also explain what will be the likely impact of those changes on data subjects. However, compliance with transparency requirements do es not “whitewash” a situation where the changes to the processing are so signifi cant that the processing becomes completely different in natu re to what it was before. WP29 emphasises that all of the other rules in the GDPR, including those relating to incompatible further processing, continue to apply irrespective of compliance with t he transparency obligations. 32. g. contained in a privacy statement/ notice ) does not materially change, it is likely that data subjects who have been using a service for a significant period of time will not recall the information provided to them at the outset under Articles 13 and/or 14.

WP29 recommends that c ontrollers facili t ate data subjects to have continu ing easy access to the information to re - acquaint themselves with the scope of the data processing . In accordance with the accountability principle, controllers should also consider whether , and at what intervals , it is appropriate for them to provide express reminders to data subjects as to the fact of the privacy s tatement/ notice and where they can find it. Modalities - format of information provision 33. ” The operative word h ere is “provide”. g. by way of a direct link , use of a QR code , etc . ) . The data subject must not have to actively search for information covered by these articles amongst other information, such as terms and conditions of use of a website or app. The example at paragraph 1 1 illustrates this point. g. whether in a digital form on a website or in paper format) which can be easily accessed should they wish to consult the entirety of the information.

34. There is an inherent tension in the GDPR between the requirements on the one hand to provide the comprehensive information to data subjects which is required under the GDPR, and on the other h and do so in a form that is concise, transparent, intelligible and easily accessible. As such, and bearing in mind the fundamental principles of accountability and fairness, controllers must undertake their own analysis of the nature, circumstances, scope and context of the processing of personal data which they carry out and decide, within the legal requirements of the GDPR and taking account of the recommendations in these Guidelines particularly at paragraph 36 below , how to prioritise information which must be provided to data subjects and what are the appropriate levels of detail and methods for conveying the information. Page 19 of 40 Layered approach in a digital environment and layered privacy statements/ notices 35.

In the digital context, in light of the volume o f information which is required to be provided to the data subj ect, a layered approach may be followed by data controllers where they opt to use a combination of methods to ensure transparency. WP29 recommends in particular that layered privacy statements/ notices should be used to link to the various categories of information which must be provided to the data subject, rather than displaying all such information in a single notice on the screen , in order to avoid information fatigue . Layered privacy statements/ notices can help resolve the tension between completeness and understanding , notably by allowing users to navigate directly to the section of the statement/ notice that they wish to read. It should be noted that layered privacy statements/ noti ces are not merely nested pages that require several clicks to get to the relevant information.

The design and layout of the first layer of the privacy statement/ notice should be such that the data subject has a clear overview of the information available to them on the processing of their personal data and where/ how they can find that detailed information within the layers of the privacy statement/ notice . It is also important that the information contained within the different layers of a layered notice is consistent and that the layers do not provide conflicting information. 36. As regards the content of the first modality used by a controller to inform data subjects in a layered approach (in other words the primary way in which the controller first engages with a data subject), or the content of the first layer of a layered privacy statement/ notice, WP29 recommends that the first layer / modality should include the details of the purposes of processing, the identity of controller and a description of the data subject ’s rights .

g. displayed as a data subject fills in an online form . ) The importance of providing this information upfront arises in particular from Recital 39. 34 While controllers must be able to demonstrate accountability as to what further information they decide to prioritise , WP29’s position is that , in line with the fairness principle, in addition to the information detailed above in this paragraph , the first layer / modality should al so contain information on the processing which has the most impact on the data subject and processing which could surprise them . Therefore, the data subject should be able to understand from information contained in the first layer / modality what the consequ ences of the processing in question will be for the data subject (see also above at paragraph 10 ). 37. In a digital context, aside from providing an online layered privacy statement/ notice , d ata contro llers may also choose to use additional transparency tools (see further examples considered below) which provide tailored information to the individual data subject which is specific to the position of the individual data subject concerned and the goods/ services which that data subject is availing of.

” Page 20 of 40 use of online layered privacy statements/ notices, this recommendation does not exclude the development and use of other innovative methods of compliance with transparency requirements. Layered approa ch in a non - digit al environment 38. e. a real - world environment such as person - to - person engagement or telephone communications) where multiple modalities may be deployed by data controllers to facilitate the provision of information . ) This approach should no t be confused with the separate issue of layered privacy statement s / notices. Whatever the formats that are used in this layered approach, WP29 recommends that the first “layer” (in other words the primary way in which the controller first engages with the data subject) should generally convey the most important information (as referred to at paragraph 36 above), namely the details of the purposes of processing, the identity of controller and the existence of the rights of the data subject, together with information on the greatest impact of processing or processing which could surprise the data subject.

For example , where the first point of contact with a data subject is by telephone, this information could be provided during the telephone call with the d ata subject and they could be provided with the balance of the information required under Article 13/ 14 by way of further, different means, such as by sending a copy of the privacy policy by email and/ or sending the data subject a link to the controller’ s layered online privacy statement/ notice. “Push” and “pull” notices 39. Another possible way of providing transparency information is through the use of “push” and “pull” notices. Push notices involve the provision of “just - in - time” transparency informati on notices while “pull” notices facilitate access to information by methods such as permission management, privacy dashboards and “learn more” tutorials. These allow for a more user - centric transparency experience for the data subject.

 A privacy dashboard is a single point from which data subjects can view ‘privacy information’ and manage their privacy preferences by allowing or preventing their data from being used in certain ways by the service in question. This is particularly useful when the same service is used by data subjects on a variety of different devices as it gives them access to and control over their personal data no matter how they use the s ervice. Allowing data subjects to manually adjust their privacy settings via a privacy dashboard can also make it easier for a privacy statement/ notice to be personalised by reflecting only the types of processing occurring for that particular data subjec t. g. by using the same design and branding as the rest of the service) is preferable because it will ensure that access and use of it will be intuitive and may help to encour age users to engage with this information, in the same way that they would with other aspects of the service.

This can be an effective way of Page 21 of 40 demonstrating that ‘privacy information’ is a necessary and integral part of a service rather than a lengthy list of legalese.  A just - in - time notice is used to provide specific ‘privacy information’ in an ad hoc manner, as and when it is most relevant for the data subject to read. This method is useful for providing information at various points throughout the process of data collection; it hel ps to spread the provision of information into easily digestible chunks and reduces the rel iance on a single privacy statement / notice containing information that is difficult to understand out of context. For example, if a data subject purchases a product online, brief explanatory information can be provided in pop - ups accompa nying relevan t fields of text. T he information next to a field requesting the data subject’s telephone number could explain for example that this data is only being collected for the purpos es of contact regarding the purchase and that it will only be disclosed to the delivery service.

Other types of “appropriate measures” 40. Given the very high level of internet access in the EU and the fact that data subjects can go online at any time, from multiple locations and different devices, as stated above, WP29 ’s position is that an “appropriate measure” for providing transparency information in the case of data controllers who maintain a digital/ online presence, is to do so through an electronic privacy statement / notice . However, based on the circumstances of the data collection a nd processing, a data controller may need to additionally (or alternatively where the data controller does not have any digital/online presence) use ot her modalities and formats to provide the information . Other possible ways to convey the information to t he data subject arising from the following different personal data environments may include the following modes applicable to the relevant environment which are listed below.

As noted previously, a layered approach may be followed by controllers where they opt to use a combination of such methods while ensuring that the most important information (see paragraph 36 and 38 ) is always conveyed in the first modality used to communicate with the data subject. a. Hard copy/ paper environment, for example when enter ing into contracts by postal means : written explanations , leaflets, information in contractual documentation, cartoons, infographic s or flowcharts; b. Telephonic environment : oral explanations by a real person to allow interaction and questions to be answered or automated or pre - recorded information with options to hear further more detailed information; c. Screenless smart technology/ IoT environment such as Wi - Fi tracking analytics : icons, QR codes, voice alerts, written details incorporated into paper set - up instructions , videos incorporated into digital set - up instructions, written information on the smart device, messages sent by SMS or email , visible boards containing the information, public signage or public information campaigns; d.

Person to person environment, such as responding to opinion polls, registering in person for a service : oral explanations or written explanations provided in hard or soft copy format; Page 22 of 40 e. “Real - life” environment with CCTV/ drone recording : visible boards containing the informa tion, public signage, public information campaigns or newspaper/ media notices. Information on profiling and automated decision - making 41. 4, together with meaningful information about the logic involved and the significant and envisaged consequences of the processing for the data subject, forms part of the obligatory information which must be provided to a data subject under Articles 13. 2(g). W P29 has produced guidelines on automated individual decision - making and p rofiling 35 which should be referred to for further guidance on how transparency should be given effect in the particular circumstances of profiling.

2(g), the comments in these guidelines relating to the importance of informing data subjects as to the consequences of processi ng of their personal data , and the general principle that data subjects should not be taken by surprise by the processing of their personal data , equally appl y to profiling generally (not just profiling which is captured by Article 22 36 ) , as a type of processing . 37 Other issues – risks, rules and safeguards 42. Recital 39 of the GDPR also refers to the provision of certain information which is not explicitly covered by Article s 13 and Article 14 (see re cital text above at paragraph 2 8 ). The reference in th is recital to making data subjects aware of the risks, rules and safeguards in relation to the processing of personal data is connected to a number of other issues. These include data protection impact assessments (DPIAs). As set out in the WP29 Guidelines on DPIAs , 38 data controllers may consider publication of the DPIA (or part of it), as a way of fostering trust in the processing operations and demonstrating transparency and accountability, although such publication is not obligatory.

Furthermore, adheren ce to a code of conduct ( provided for under Article 40) may go towards demonstrating transparency , as codes of conduct may be drawn up for the purpose of specifying the application of the GDPR with regard to : fair and transparent processing ; information pr ovided to the public and to data subjects ; and information provided to, and the protection of , children, amongst other issues. 43. Another relevant issue relating to transparency is data protection by design and by default ( as required under Article 25). These principles require data controllers to build data 35 Guidelines on Automated individual decision - making an d Profiling for the purposes of Regulation 2016/679, WP 251 36 This applies to decision - making based solely on automated processing, including profiling , which produces legal effects concerning the data subject or similarly significantly affects him or her.

37 Recital 60, which is relevant here, states that “Furthermore, the data subject should be informed of the existence of profiling and the consequences of such profiling”. 1 Page 23 of 40 protection considerations into their processing operations and systems from the ground up, rather than taking account of data protection as a last - minute compliance issue. Recital 78 refe rs to data controllers implementing measures that meet the requirements of data protection by design and by default including measures consisting of transparency with regard to the functions and processing of personal data. 44. Separately, the issue of joint controllers is also related to making data subjects aware of the risks, rules and safeguards. 1 requires joint controllers to determine their respective responsibilities for complying with obligations under the GDPR in a transparent manner, in particular with regard to the exercise by data subjects of their rights and the duties to provide the information under Articles 13 and 14.

2 requires that the essence of the arrangement between the data controllers must be made available to the data subject. In other words, it must be completely clear to a data a subject as to which data controller he or she can approach where they intend to exercise one or more of their rights under the GDPR . 39 Information related to f urther processing 45. Both Ar ticle s 13 and Article 14 contain a provision 40 that requires a data controller to inform a data subject if it intends to further process their personal data for a purpose other than that for which it was collected/ obtained. If so, “the controller shall pro vide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2”. 1(b) that person al data shall be collected for specified, explicit and legitimate purposes , and further processing in a manner that is incompatible with these purposes is prohibited.

1, not be considered to be incompatible with the initial purposes. 4 apply. 1, a data subject may exercise his or her rights under the GDPR in respect of and against each of the joint data controllers. 4, which are expressed in identical term s , apart from the word “collected”, which is used in Article 13 , and which is replaced with the word “obtained” in Article 14. 4 sets out, in non - exhaustiv e fashion, the factors which are to be taken into account in ascertaining whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, namely: the link between the purposes; the context in which the personal data have been collected; the nature of the personal data (in particular whether special categories of personal data or personal data relating to criminal offences and convictions are included); the possible consequences of the intended furth er processing for data subjects; and the existence of appropriate safeguards.

Page 24 of 40 for a particular purpose may take place . 43 In other words, a data subject should not be taken by surprise at the purpose of processing of their persona l data. 46. e. 2 as applicable) that should be provided to the data subject. (Recital 61 refers to this as “ other necessary information ”. ) However the default posi tion is that all such information set out in that sub - article should be provided to the data subject unless one or more categories of the information does not exist or is not applicable. 47. 4 44 where a legal basis other than consent or national/ EU law is relied on f or the new processing purpose . (I n other words , an explanation as to how the processing for the other purpose(s) is compatibl e with the original purpose). g. the right to restriction of processing or the right to object to processing , amongst others . 45 Where controllers choose not to i nclude such information in a privacy notice / st atement , WP29 recommends that they make it clear to data subjects that they can obtain the information on request.

48. Connected to the exercise of data subject rights is the issue of timing. As emphasised above, the p rovision of information in a timely manner is a vital element of the transparency requirements under Article s 13 and 14 and is inherently linked to the concept of fair processing. Information in relation to further processing must be provided “prior to that further processing”. WP29’s positi on is that a reasonable period should occur between the notification and the processing commencing rather than an immediate start to the processing upon notification being received by the data subject. This gives data subjects the practical benefits of the principle of transparency, allowing them a meaningful opportunity to consider (and potentially exercise their rights in relation to) the further processing. What is a reasonable period will depend on the particular circumstances. The principle of fairness requires that the more intrusive (or less expected) the further processing, the longer the period should be.

Equally , the principle of accountability requires that data controllers be able to demonstrate how the determinations they have made as regards th e timing for the provision of this information are justified in the circumstances and how the timing overall is fair to data subjects. ( See also the previous comments in relation to ascertaining reasonable timeframes above at paragraph s 30 to 32 . ) 43 Recitals 47 and 50 44 Also referenced in Recital 50 45 As referenced in Recital 63, this will enable a data subject to exercise the right of access in order to be aware of and to verify the lawfulness of the processing. Page 25 of 40 Visualisation t ools 49. Importantly, the principle of transparency in the GDPR is not limited to being effected simply through language communications (whether written or oral). The GDPR provides for visualisation tools (referencing in particular, icons, certification mechanisms, and data protection seals and marks) where appropriate.

Recital 58 46 indicates that the accessibility of information addressed to the public or to data subjects is especially important in the online environment. 47 Icons 50. Recital 6 0 makes provision for information to be provided to a data subject “in combination” with standardised icons, thus allowing for a multi - layered approach. However, the use of icons should not simply replace information necessary for the exercise of a data su bject’s rights nor should they be used as a substitute to compliance with the data controller’s obligations under Articles 13 and 14. 7 provides for the use of such icons stating that: “The information to be provided to data subjects pursuant t o Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where icons are presented electronically they shall be machine - readable”.

51. 7 states that “Where the icons are presented electronically, they shall be machine - readable”, this suggests that there may be situations where icons are not presented electronically , 48 for example icons on physical paperwork, IoT devices or IoT device packaging, notices in public places about Wi - Fi tracking, QR codes and CCTV notices. 52. Clearly, the purpose of using icons is to enhance transparency for data subjects by potentially reduci ng the need for vast amounts of written information to be presented to a data subject. However, the utility of icons to effectively convey information required under Articles 13 and 14 to data subjects is dependent upon the standardisation of symbols/ imag es to be 46 “Such information could be provided in electronic form, for example, when addressed to the public, through a website. g. red - green colour blindness ) . 48 There is no definition of “ machine - readable ” in the GDPR but Recital 21 of Directive 2013/37/EU17 defines “machine - readable” as: “a file format structur ed so that software applications can easily identify, recognize and extract specific data, including individual statements of fact, and their internal structure.

Certification mechanisms, seals and marks 53. Aside from the use of standardised icons, the GDPR (Article 42) also provides for the use of data protection certification mechanisms, data protection seals and marks for the purpose of demonstrating compliance with the GDPR of processing operations by data controllers and proc essors and enhancing transparency for data subjects. 50 WP29 will be issuing g uidelines on certification m echanisms in due course . Exercise of d ata s ubjects’ r ights 54. e. 1) when communicating with data subjects in relation to their rights under Article s 15 to 22 and 34; and  facilitate the exercise of data subjects’ rights under Article s 15 to 22. 55. The GDPR requirements in relation to the exercise of these rights and the nature of the information required are designed to meaningfully position data subjects so that they can vindicate their rights and hold data controllers accountable for the processing of their personal data.

8 provides that the Commission is empowered to adopt delegated acts under Article 92 for the purpose of determining the information to be presented by the icons and the information for providing standardised icons. Recital 166 (which deals with delegated acts of the Commission in general) is instructive, providing that the Commission must carry out appropriate consultations during its preparatory work, including at expert level. 1 (r) states that the EDPB shall on its own initiative or, where relevant, at the request of the Commission, provide the Commission with an opinion on icons. 50 See the reference in Recital 100 51 Under the Transparency and Modalities section of the GDPR on Data Subject Rights (Section 1, Chapter III, namely Article 12) 52 Access, rectification, erasure, restriction on processing, object to processing, portability Page 27 of 40 for requests to be made electronically, especially where personal data are processed by electronic means”.

The modality provided by a data controller for data subjects to exercise their rights should be appropriate to the context and the nature of the relationship and interactions between the controller and a data subject. To this end, a data controller may wi sh to provide one or more different modalities for the exercise of rights that are reflective of the different ways in which data subjects interact with that data controller. Example A health service provider uses an electronic form on its website , and paper forms in the receptions of its health clinics, to facilitate the submission of access requests for persona l data both online and in person . While it provides these modalities, the health service still accepts access requests submitted in other ways (such as by letter and by email) and provides a dedicated point of contact (which can be accessed by email and by telephone) to help data subjects with the exercise of their rights.

Exceptions to the obligation to provide information Article 13 exceptions 56. The only exception to a data controller’s Article 13 obligations where it has collected personal data directly from a data subject occurs “where and insofar as, the data subject already has the information” . 53 The principle of accountability requires that data controllers demonstrate (and document) what information the data subject already has, how and when they received it and that no changes have since occurred to that information that would render it out of date. 2. 4 exception should be constru ed. 2 information at the point of sign - up. Six months later the data subject activates a connected instant message functionality through the email service pr ovider and provides their mobile telephone number to do so. g. g. the identity and contact details of the controller and the data protection officer, information on data subject right s and the right to complain to the relevant supervisory authority).

As a matter of best practice however, the complete suite of information should be provided to the data subject again but the data subject also should be able to easily tell what informatio n amongst it is new . The new processing for the purposes of the instant messaging service may affect the data subject in a way which would prompt them to seek to exercise a right they may have forgotten about, having been informed six months prior. Providi ng all the information again helps to ensure the data subject remains well informed about how their data is being used and their rights. Article 14 exceptions 57. Article 14 carves out a much broader set of exceptions to the information obligation on a dat a controller where personal data has not been obtained from the data subject. These exceptions should, as a general rule, be interpreted and applied narrowly. 5 also allows for the following exceptions:  The provision of such information is impossible or would involve a disproportionate effort , in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or where it would make the achievement of the objectives of the processing impossible or seriously impair them;  The data controller is subject to a national law or EU law requirement to obtain or disclose the personal data and that the law provides appropriate protections for the data subject’s legitimate interests ; or  An obligation of professional secrecy (including a statutory obligation of secrecy) which is regulated by national or EU law means the personal data must remain confidential.

Proves impossible , disproportionate effort and serious impairment of objectives 58. 1 would make the achievement of the objectives of the processing impossible or seriousl y impair them. Page 29 of 40 “Proves impossible” 59. 5(b) to provide the information is an all or nothing situation because something is either impossible or it is not; there are no degrees of impossibility. Thus if a data controller seeks to rely on this exemption it must demonstrate the factors that actually prevent it from providing the information in question to data subjects. If, after a certain period of time, the factors that caused the “impossibili ty” no l onger exist and it becomes possible to provide the information to data subjects then the data controller should immediately do so. In practice, there will be very few situations in which a data controller can demonstrate that it is actually impossible to p rovide the information to data subjects.

The following example demonstrates this. Example A data subject registers for a post - paid online subscription service. After registration, the data controller collects credit data from a credit - reporting agency on the data subject in order to decide whether to provide the service. 3(a). However, the data subjec t’s address and phone number is not registered in public registries (the data subject is in fact living abroad). The data subject did not leave an email address when registering for the service or the email address is invalid. The controller finds that it has no means to directly contact the data subject. In this case, however, the controller may give information about collection of credit reporting data on its website, prior to registration. In this case, it would not be impossible to provide information p ursuant to Article 14. Impossibility of providing the source of the data 60.

Recital 61 states that “ where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided ”. The lifting of the requirement to provide data subjects with information on the source of their personal data applies only where this is not possible because different pieces of personal data relating to the same data subject cannot be attributed to a p articular source. For example, the mere fact that a database comprising the personal data of multiple data subjects has been compiled by a data controller using more than one source is not enough to lift this requirement if it is possible (although time co nsuming or burdensome) to identify the source from which the personal data of individual data subjects derived. Given the requirements of data protection by design and by default , 54 transparency mechanisms should be built into processing systems from the gr ound up so that all sources of personal data received into an organisation can be tracked and traced back to their source at any point in the data process ing life cycle (see paragraph 43 above).

54 Article 25 Page 30 of 40 “Disproportionate effort” 61. 5(b), as with the “proves impossibl e” situation, “disproportionate effort” may also apply , in particular, for processing “for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the safeguards referr ed to in Article 89(1)”. Recital 62 also references these objectives as cases where the provision of information to the data subject would involve a disproportionate effort and states that in this regard, the number of data subjects, the age of the data an d any appropriate safeguards adopted should be taken into consideration. 5(b) on archiving, research and statistical purposes with regard to the application of this exemption, WP29’s position is that this e xc eption should not be routinely relied upon by data controllers who are not processing personal data for the purposes of archiving in the public interest, for scientific or historical research purpos es or statistical purposes.

1 must still be complied with and the provision of the information must constitute a disproportionate effort . 62. 5(b), it is relevant that there are no comparable exemptions under Article 13 (where personal data is collected from a data subject). The only difference between an Article 13 and an Article 14 situation is that in the latter , the personal data is not collected from the data subject. It therefore follows that impossibility or disproportionate effort typically arise s by virtue of circumstances which do not apply if the personal data is collected from the data subject. In other words, the impossibility or disproportionate effort must be directly connected to the fact that the personal data was obtained other than from the data subject. Example A large metropolitan hospital requires all patients for day procedures, longer - term admissions and appointments to fill in a Patient Information Form which seeks the details of two next - of - kin ( data subjects).

Given the very large volume of patients passing through the hospital on a daily basis, it would involve disproportionate effort on the part of the hospital to provide all persons who have been listed as next - of - kin on forms filled in by patients each day with the informa tion required under Article 14. 63. The factors referred to above in Recital 62 (number of data subjects, the age of the data and any appropriate safeguards adopted) may be indicative of the types of issues that contribute to a data controller having to use disproportionate effort to notify a data subject of the relevant Article 14 information. Example H istorical researchers seeking to trace lineage based on surnames indirectly obtain a large dataset relating to 20,000 data subjects. However , the dataset was collected 50 Page 31 of 40 years ago , has not been updated since, and does not contain any contact details.

Give n the size of the database and more particularly, the age of the data, it would involve disproportionate effort for the researchers to try to trace the data subjects indiv idually in order to provide them with Article 14 information. 64. 5(b) on the basis that provision of the information would involve a disproportionate effort, it should carry out a balancing exercise to assess the effort involved for the data controller to provide the information to the data subject against the impact and effects on the data subject if he or she was not provided with the information. This assessment should be documented by the data controller in accordance with its accountability obligat ions. 5(b) specifies that the controller must take appropriate measures to protect the data subject’s rights , freedoms and legitimate interests . T his applies equally where a controller determines that the provision of the information proves impossible, or would likely render impossible or seriously impair the achievement of the objectives of the processing.

5(b), that controllers must always take is to make the information public ly available. A controller can do this in a number of ways, for instance by putting the information on its website, or by proactively advertising the information in a newspaper or on posters on its premises. Other appropria te measures , in addition to making the information publicl y available , will depend on the circumstances of the processing, but may include: undertaking a data protection impact assessment; applying pseudonymisation techniques to the data; minimising the da ta collected and the storage period; and implementing technical and organisational measures to ensure a high level of security. Furthermore, there may be situations where a data controller is processing personal data which does not require the identificati on of a data subject (for example with pseudonymised data). 1 may also be relevant as it states that a data controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subje ct for the sole purposes of complying with the GDPR.

Serious i mpairment of o bjectives 65. 1 is likely to make impossible or seriously impair the achievement of the processing objectives. 1 alone would nullify the objectives of the processing. 5(b) pre - supposes that the data processing satisfies all of the principles set out in Article 5 and that most importantly, in all of the circumstances, the processing of the personal data is fair and that it has a legal basis. Example B ank A is subject to a mandatory requirement under anti - money laundering legislation to report suspicious activity relating to accounts held with it to the relevant financial law enforcement authority. Bank A receives information from Bank B (in Page 32 of 40 another Member State) that an account holder has instructed it to transfer money to another account held with Bank A which appears suspicious. Bank A passes this data concerning its account holder and the suspicious activities to the relev ant financial law enforcement authori ty.

The anti - money laundering legislation in question makes it a criminal offence for a reporting bank to “tip off” the account holder that they may be subject to regulatory investigations. 5(b) applies because providin g the data subject (the account holder with Bank A ) with Article 14 infor mati on on the processing of account holder’s personal data received from Bank B would seriously impair the objectives of the legislation , whic h includes the prevent ion of “tip - offs”. However, general information sh ould be provided to all account holders with Bank A when an account is opened that their personal data may be processed for anti - money laundering purposes. Obtaining or disclosing is expressly laid down in law 66. 4 insofar as the obtaining or disclosure of personal data “is expressly laid down by Union or Member State law to which the controller is subject” . This exemption is conditional upon the law in question providing “appropriate measures to protect the data subject’s legitimate interests”.

S uch a law must directly address the data controller and the obtaining or disclosure in ques tion should be mandatory u pon the data controller. Accordingly , the data controller must be able to demonstrate how the law in question applies to them and requires them to either obtain or disclose the personal data in question. While it is for Union or M ember State law to frame the law such that it provide s “ appropriate measures to protect the data subject’s legitimate interests”, the data controller should ensure (and be able to demonstrate ) that its obtaining or disclosure of personal data complies with those measures. Furthermore, the data controller should make it clear to data subjects that it obtains or discloses personal data in accordance with the law in question, unless there is a legal prohibition preventing the data controller from doing so. Thi s is in line with Recital 41 of the GDPR, which states that a legal basis or legislative m easure should be clear and precise, and its application should be foreseeable to persons subject to it, in accordance with the case law of the Court of Justice of the EU and the European Court of Human Rights.

5(c) wil l not apply where the data controller is under an obligation to obtain data directly from a data subject , in which case Article 13 will apply . e. where and insofar as the data subject already has the information) . H owever , as referred to below at paragraph 68, at a national level, Member States may also legislate, in accordance with Article 23, for further specific restrictions to the right to transparency under Article 12 and to information under Articles 1 3 and 14 . Example A tax authority is subje ct to a mandatory requirement under national law to obtain the details of employee s ’ salaries from their employer s . The personal data is not obtained Page 33 of 40 from the data subject s and therefore the tax authority is subject to the requirements of Article 14. A s the obta ining of the personal data by the tax authority from employers is expressly laid down by law , the information requirements in Article 14 do not apply to the tax authority in this instance.

Confidentiality by virtue of a secrecy obligation 67. 5(d) provides for an exemption to the information requirement upon data controllers where the personal data “must remain confidential subject to an obligation of professional secrec y regulated by Union or Member S tate law, including a statutory obligati on of secrecy”. 4 to the data subject. Example A medical practitioner (data controller) is under a professional obligation of secrecy in relation to his patients’ medical information. A patient (in respect of whom the obligation of professional secrecy applies) provides the medical practitioner with information about her health relating to a genetic condition, which a number of her close relatives also have. The patient also provides t he medical practitioner with certain personal data of her relatives (data subjects) who have the same condition. 5(d) applies. If the medical practitioner were to provide the Article 14 information to the relatives, the obligation of professional secrecy, which he owes to his patient, wou ld be violated.

Restrictions on d ata subject rights 68. 1(a) to (j). Where such national measures lessen either the specific data subject rights or the general transparency obligations , which would otherwise apply to data controllers under the GDPR, the data co ntroller should be able to demonstrate how the national provision applies to them. 2( h), the legislative measure must contain a provision as to the right of the data subject to be informed about a restriction on 55 As set out in Articles 12 to 22 and 34, and in Article 5 insofar as its provisions correspond to the rights and obligations provided for in Articles 12 to 22. Page 34 of 40 their rights , unless so informing them may be prejudicial to the purpose of the restriction . Consistent with this , and in line wi th principle of fair n ess, the data controller should also inform data subjects that they are relying on (or will rely on , in the event of a particular data subject right being exercised) such a national l egislative restriction to the exercise of data subje ct rig h ts, or to the transparency obligation , unless doing so would be prejudicial to the purpose of the legislative restriction.

As such , transparency requires data controllers to provide adequate upfront information to data subjects about their rights an d any particular caveats to those rights which the controller may seek to rely on, so that the data subject is not taken by surprise at a purported restriction of a particular right when they later attempt to exercise it against the controller. In relation to pseudonymisation and data minimisation, and insofar as data controllers may purport to rely on Article 11 of the GDPR, WP29 has previously confirmed in Opinion 3/ 2017 56 that Article 11 of the GDPR should be interpreted as a way of enforcing genuine data minimisation without hindering the exercise of data subject rights , and that the exercise of data subject rights must be made possible with the help of additional informa tion provided by the data subject. 69. Additionally, Article 85 requires Member States, by law, to reconcile data protection with the right to freedom of expression and information.

This requires, amongst other things, that Member States provide for appropri ate exemptions or derogations from certain provisions of the GDPR (including from the transparency requirements under Articles 12 - 14) for processing carried out for journalistic, academic, artistic or literary expression purposes , if they are necessary t o reconcile the two rights. Transparency and d ata b reaches 70. WP29 has produced separate Guidelines on Data Breaches 57 but for the purposes of these guidelines, a data controller’s obligations in relation to communication of data breaches to a data subject must take full account of the transparency requirements set out in Article 12 . 58 The communication of a data breach mu st satisfy the same requirements, detailed above (in particular for the use of clear and plain language), that apply to any other communication with a data subject in relation to their rights or in connection with conveying information under Articles 13 an d 14.

1 w hich specifically refers to “ … any communication under Articles 15 to 22 and 34 relating to processing to the data subject. ” [emphasis added]. Page 36 of 40 measures based on Article 6 . 1 is processed , where applicable the relevant Union or Member State law under which the processing is carried out should be specified. 2(b) T he specific interest in question must be identified for the benefit of the data subject. 1(f) as a lawful basis for processing, in advance of any collection of data su bjects’ personal data . To avoid information fatigue, this can be included within a layered privacy statement/ notice (see paragraph 3 5 ) . In any case , the WP29 position is that information to the data subject should make it clear that they can obtain inform ation on the balancing test upon request. This is essential for effective transparency where data subjects have doubts as to whether the balancing test has been carried out fairly or they wish to file a complaint with a supervisory authority.

1(d) This information is required in an Article 14 scenario because the pers onal data has not been obtained from the data subject , who therefore lacks an awareness of which categories of their personal data the data controller has obtained. 9 as “a natural or legal person, public authority, agency or another body, to wh ich the personal data are disclosed, whether a third party or not ” [emphasis added]. As such , a recipient does not have to be a third party. Therefore, other data controllers, joint controllers and processors to whom data is transferred or disclosed are co vered by the term “ recipient ” and information on such recipients should be provided in addition to information on third party recipients . The actual (named) recipients of the personal data, or the categories of recipients, must be provided. In accordance with the principle of fairness, controller s must provide information on the recipients that is most meaningful for data subjects .

In practice, this will generally be the named recipients, so that data subjects know exactly who has their personal data. e. by reference to the activities it carries out), the industry, sector and sub - sector and the location of the recipients . g. 2/ derogation s and safeguards under Article 49 etc. ) should be specified . g. by provid ing a link to the mechanism used . In accordance with the principle of fairness, the information provided on transfers to third countries should be as meaningful as possible to data subjects; this will generally mean that the third countries be named. 1(e). The storage period (or criteria to determine it) may be dictated by factors such as statutory requirements or industry guidelines but should be phrased in a way that allows the data subject to assess, on the basis of his or her own situation, what the retention period will be for specific data/ purposes.

It is not sufficient for the data controller to generically state that personal data will be kept as long as necessary for the legitimate purposes of the processing. 3 63 In accordance with Article 45 Page 39 of 40 categories of p ersonal data and/or different processing purposes, including where appropriate , archiving periods. The rights of the data subject to:  access;  rectification;  erasure;  restriction on processing;  objection to processing and  portability. 2(c) This information should be specific to the processing scenario and include a summary of what the right involves and how the data subject can take steps to exercise it and any limitations on the rig ht (see paragraph 68 above). In par ticular, t he right to object to processing must be explicitly brought to the data subject’s attention at the latest at the time of first communication w ith the data subject and must be presented clearly and separately from any other information .

64 In relati on to the right to portability, see WP29 Guidelines on the right to data portability . 2(d) This information should include how consent may be withdrawn, taking into account that it should be as easy for a data subject to withdraw consent as to give it . 2(e) This information should explain that , in accordance with Article 77, a data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or of an alleged infringement of the GDPR . 3 Page 40 of 40 enter into a contract or whether there is an obligation to provide the information and the possible consequences of failure. information to a current or prospective employer. Online forms should clearly identify which fields are “required”, which are not, and what will be the consequences of not filling in the required fields. 2(f) The specific source of the data should be provided unless it is not possible to do so – see further guidance at paragraph 60 . e. publicly/ privately held sources ) and the types of organisation/ industry/ sector . 2(g) See WP29 Guidelines on automated individual decision - making and Profiling . 67 67 Guidelines on Automated individual decision - making and Profi ling for the purposes of Regulation 2016/679, WP 251