Individuals right to information is about how to collect and use their personal data. This right has led to several information-related obligations that companies need to fulfil. In particular, the main goal of these obligations is to be clear and open about your processing activities.
Reading time: 1,5 minutes.
Principle of transparency
The right to be informed stems from the general principle of transparency. In summary, it is about being open and clear about how you collect and process individuals’ personal data. The principle of transparency creates several legal obligations that companies need to respect. You can find the principle of transparency in Article 5(1)(a) of the GDPR. It is in the same article as the principles of lawfulness and fairness. This shows the importance of transparency under the GDPR.
Information to individuals
Individuals right to information consists of important requirements relating to transparency. These requirements oblige companies to be open about how they process personal data.
Articles 13 and 14 of the GDPR state what information you need to provide to individuals. This depends on where the company has obtained the information from: is it from the individual or elsewhere?
Some information you must always provide, such as name and contact details. You also need to provide information about processing purposes, legal basis and retention periods. You need to inform individuals about their rights and the possibility to lodge a complaint.
It is important to review and update the information you provide on a regular basis.
How to inform
Companies need to take appropriate and active measures to provide information to individuals. According to the principle of transparency, the information needs to be clear, concise, and easy to both access and understand. You need to adapt the information for children if they are to receive it.
Furthermore, you should provide the information in writing, or by other means, this includes electronic means (if appropriate). Therefore, you need to provide it orally if the individual requests this and if you can prove their identity by other means.
As a rule, it is a good idea to provide information by using a mix of different techniques – for example, by using different layers to highlight key aspects. This will make the information clearer and more intelligible.
The information needs to be provided free of charge.
When to inform individuals
When you collect personal data from the individual, you need to provide information to individuals when you obtain it.
If you do not collect personal data from the individual, you need to provide information within a reasonable period after obtaining it – and within one month at the latest.
Also, if you use the data to communicate with the individual, you need to provide information no later than the occasion of the first communication.