Transparency

Legal Framework

Transparency is established as a foundational data protection principle under Article 5(1)(a) GDPR, requiring that personal data be:

This principle operates not in isolation but as an enabling condition: without transparent information provision, other GDPR rights — including consent withdrawal and access — become functionally inaccessible. The EDPB has framed this in stark terms:

"If the controller does not provide accessible information, user control becomes illusory and consent will be an invalid basis for processing."
— EDPB Guidelines 05/2020 §62

In the employment context, Article 88(2) GDPR requires member states to adopt specific measures safeguarding the transparency of processing alongside data transfers and workplace monitoring — recognizing that power imbalances in employment demand heightened transparency obligations.

The AI Act extends transparency obligations beyond traditional data protection. Article 1(2)(d) establishes "harmonised transparency rules for certain AI systems," while Article 112(2)(b) provides for periodic review of which AI systems require additional transparency measures under Article 50 of the AI Act.

Key Developments

The CJEU's jurisprudence reveals that transparency is not an absolute value but must be balanced against competing fundamental rights. In Client Earth v. EFSA, the Court established a critical baseline:

"no automatic priority can be conferred on the objective of transparency over the right to protection of personal data"
— Client Earth ¶51

Yet the same case affirmed transparency's democratic function:

"The transparency of the process followed by a public authority for the adoption of a measure of that nature contributes to that authority acquiring greater legitimacy"
— Client Earth ¶56

The Schrems litigation exposed how transparency deficits in international transfer frameworks — specifically "structural shortcomings related to transparency and enforcement" — can invalidate entire adequacy mechanisms. The Schecke ruling grounded transparency obligations in the European Transparency Initiative, linking public fund disclosure to sound financial management.

Italian DPA enforcement illustrates practical failure modes: the Garante fined a health authority €20,000 for publishing personal data in a resolution, and €50,000 against an agency whose remote work policy lacked adequate transparency.

Status of the Debate

This topic is actively contested in court. The core tension — transparency versus data protection — has been addressed at the principle level in Client Earth, but operational boundaries remain unresolved. Courts diverge on how to weigh transparency interests when disclosure would expose personal data, particularly in institutional decision-making involving expert advisors with vested interests. No definitive court split is on record, but the balancing test lacks granular criteria. Resolution will likely require further CJEU guidance on proportionality assessment — specifically, whether the necessity test for transparency disclosure should require consideration of anonymization alternatives before raw personal data is exposed.

Practical Guidance

• Implement layered information architecture: EDPB guidance endorses "layered and granular information" to reconcile completeness with accessibility — provide concise summaries with drill-down capability for full details.
• Conduct transparency-by-design assessments: For each processing activity, document what information is provided, when, and through what channel, mapping directly to Article 5(1)(a) requirements.
• Apply heightened transparency in employment contexts: Under Article 88(2), implement specific measures addressing workplace monitoring, data transfers within corporate groups, and employee dignity — go beyond generic privacy notices.
• Assess AI system transparency obligations early: With the AI Act's harmonised transparency rules under Article 1(2)(d) and periodic review under Article 112(2)(b), classify AI systems proactively and prepare disclosure mechanisms for affected individuals.
• Document the transparency–privacy balance: When transparency obligations intersect with personal data protection, record the proportionality analysis — including consideration of anonymization or partial disclosure — to demonstrate compliance with the Client Earth balancing standard.