Information Provision Modalities and Communication Methods

Legal Framework

The governing provision is Article 12 GDPR, which sets mandatory form and accessibility standards for all information provided to data subjects under Articles 13–14 and communications under Articles 15–22 and 34. The core obligation requires information to be provided:

"in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child."
— GDPR Art. 12(1)

Information must be provided in writing or by other means, including electronically; oral provision is permitted only where the data subject's identity is proven by other means. Article 7(2) GDPR extends these modalities to consent — when consent appears in a broader declaration, the request must be "clearly distinguishable from the other matters, in an intelligible and easily accessible form." Article 34(2) applies the same plain-language standard to breach communications. Controllers must respond within one month, extendable by two months for complex or numerous requests, with electronic requests answered electronically.

Key Developments

The Belgian DPA (APD) rejected the argument that deficient information provision has no practical impact on data subjects, affirming that transparency obligations are independently enforceable:

"The right to data protection is a fundamental right of everyone and as such enshrined in Article 8 of the Charter of Fundamental Rights of the European Union."
— Belgian DPA (APD), §78

The Italian DPA (Garante) sanctioned TIM for "incorrect and non-transparent information on data processing" and "invalid methods of consent," including paper forms bundling a single consent across multiple purposes. On breach-communication modalities, the EDPB recommends choosing channels that maximize reach:

"A notification solely confined within a press release or corporate blog would not be an effective means of communicating a breach to an individual."
— EDPB Guidelines 9/2022, §90

Dutch courts are testing what "accessible form" concretely requires. A claimant challenged a government disclosure under Article 12(1), arguing that the absence of a structured inventory rendered the disclosure non-transparent:

"niet aan de wettelijk eis is voldaan om informatie bij inzageverzoeken in een transparante, begrijpelijke en gemakkelijk toegankelijke vorm te verstrekken (artikel 12, lid 1 AVG)"
— Rechtbank, ¶39

The Raad van State confirmed that controllers processing large volumes may ask data subjects to specify their requests before provision, grounded in recital 63 — a practical balancing of accessibility against administrative burden.

Status of the Debate

This topic is actively litigated but with converging enforcement signals. Courts and DPAs consistently treat Article 12's form requirements as independently enforceable — not merely derivative of substantive content obligations. The Belgian APD expressly rejected the notion that transparency deficiencies are harmless where processing is statistical. No court split is on record yet, but the outer boundaries remain unsettled: what counts as "easily accessible" in complex digital environments, whether a missing inventory list defeats compliance, and when oral provision suffices. A ruling clarifying the concrete threshold for structured accessibility in voluminous-data contexts would resolve the principal open question.

Practical Guidance

• Layer your notices: Present essential information first in plain language, with detailed layers available on demand. Article 12(1) demands "concise" and "intelligible" — not exhaustive — presentation.
• Separate consent from other terms: Physically and visually distinguish consent requests within broader declarations. Bundled consent forms triggered Italian DPA enforcement against TIM.
• Match the medium to the audience for breach notices: Use direct channels (email, SMS) rather than passive publication. The EDPB expressly disapproves of press-release-only notifications.
• Verify identity before oral provision: Article 12(1) permits oral information only where identity is proven by other means. Build verification steps into your request-handling workflow.
• Provide structure for voluminous disclosures: Proactively offer categorization or an index. Courts expect structured accessibility, and controllers may request specification under recital 63 where volume is genuinely large.