Fairness & Transparency

Legal Framework

Fairness and transparency are co-principles with lawfulness in Article 5(1)(a) GDPR, but they operate through specific operational provisions — chiefly Articles 13 and 14 GDPR, which mandate information duties when data is collected from or obtained about the data subject. These articles do not merely require disclosure; they frame transparency as the mechanism through which fairness is delivered.

Article 13 requires that, at the time personal data are obtained from the data subject, the controller provide identity and contact details, purposes and legal basis, recipients, retention periods, and information on data subject rights. Article 14 imposes parallel obligations where data has not been obtained directly from the subject. Both articles explicitly tie these requirements to fairness:

"the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing"
— GDPR Art. 13(2)

Article 15 reinforces this architecture by granting the data subject an access right that mirrors the transparency obligations — purposes, categories of data, recipients, retention, source, and automated decision-making information must all be provided on request.

The interplay between Article 6 (lawful basis) and the transparency articles is structural: a controller cannot claim a lawful basis without disclosing it, and fairness demands that the disclosed basis correspond to the actual processing.

Key Developments

The CJEU's ruling in Bara (2015) established that the fairness requirement obliges public bodies to inform data subjects even when data is transferred between administrative bodies — a scenario where controllers might assume no transparency duty arises:

"the requirement of fair processing of personal data laid down in Article 6 of Directive 95/46 requires a public administrative body to inform the data subjects of the transfer of those data to another public administrative body"
— Bara ¶34

The Rynes decision (2014) further clarified that where data is not obtained from the subject, the controller must provide at least identity, purposes, and any further information necessary to guarantee fair processing, including categories of data and the existence of access and rectification rights.

Dutch enforcement illustrates the practical burden. In a livestream case, the court held that the controller bore the burden of proving that processing was lawful, fair, and transparent — and that a bare assertion of necessity was insufficient:

"het op de weg van eiseres ligt om te bewijzen dat zij persoonsgegevens verzamelt op een ten aanzien van betrokkenen rechtmatige, behoorlijke en transparante wijze"
— Rechtbank ¶10.9.1

The EDPB has reinforced that fairness constrains even the transition between lawful bases — controllers cannot freely swap bases without ensuring continued fair processing.

Status of the Debate

This topic is actively contested in court. While the core obligation — that controllers must inform data subjects to ensure fair and transparent processing — is well established, the boundaries of what constitutes sufficient transparency in novel processing contexts (live streaming, inferred data, secondary use of publicly available data) remain in flux. Courts diverge on how far the fairness principle extends when data subjects are in public spaces or when processing serves a public-interest function. No definitive CJEU ruling under the GDPR itself has yet resolved these tensions. A future CJEU reference clarifying the proportionality analysis between controller interests and transparency burdens in public-space processing would settle the open questions.

Practical Guidance

• Map every processing activity to a specific transparency article: If data is collected directly, comply with Article 13; if obtained indirectly, comply with Article 14. Do not assume public-space or public-source data exempts you.

• Document the nexus between lawful basis and disclosure: The legal basis disclosed to the data subject must match the basis actually relied upon under Article 6. Mismatch is a fairness violation independent of the lawfulness analysis.

• Prepare to prove necessity with concrete evidence: As the Dutch livestream case demonstrates, courts require controllers to substantiate necessity with specific data, not conclusory assertions. Build a proportionality file for each processing activity.

• Treat inter-organisational transfers as triggering transparency duties: Bara establishes that transfers between public bodies require informing data subjects. Apply this to private-sector data sharing arrangements as well.

• Do not swap lawful bases without a fairness assessment: The EDPB's consent guidance confirms that transitioning between bases requires ensuring continued fair processing. If a compliant transition is impossible, processing must stop.