Timeline for How does GDPR Art. 14 apply to large scale B2B data transfer
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 26, 2022 at 10:49 | comment | added | amon | @User65535 (1) I cannot give legal advice. My understanding of the GDPR is that the broker is responsible for providing Art 14 information to data subjects, but that this responsibility does not imply that the broker has to do this directly. Especially in a “joint controller” situation, a contract with A and B can be used to divide compliance tasks. (2) Law enforcement is exempt from GDPR. DVLA is a public authority and is likely authorized to disclose this information by a specific UK law, in which case Art 14(5)(c) can exempt them from having to provide you such information. | |
| Jan 26, 2022 at 9:27 | comment | added | User65535 | Can I confirm you are saying that the broker can rely on the entities A and C to provide this information, and not provide it themselves? ANPR cameras get the registration plate from the data subject, but get the name and address from the DVLA. I have had a parking ticket, generated via an ANPR camera, and have not had the information listed in art 14 sent to me. | |
| Jan 25, 2022 at 20:52 | comment | added | amon | Other remarks: pre-approval may be necessary for entering into a contract, and might then have a legal basis per Art 6(1)(b), if taken at the data subject's request. But the article you link relates to US practices, not UK practices. ANPR obtaines data directly from the data subject, so there are no Art 14 implications. Information should instead be provided under Art 13. | |
| Jan 25, 2022 at 20:52 | comment | added | amon | @User65535 Merely publishing an Art 14 notice on a website is not sufficient. Pre-Brexit, the EDPB endorsed guidelines on transparency (WP260) that explain that providing this info means a more active role. Similarly, the ICO says: “You can meet this requirement by putting the information on your website, but you must make individuals aware of it and give them an easy way to access it”. In my answer, I mention that entities A and B would direct the user to this notice. I agree that the data subjects must be told about this, but I think the broker can cooperate with others to this end. | |
| Jan 25, 2022 at 16:56 | comment | added | User65535 | "To fulfill the Art 14 requirements, a privacy notice is published on its website." Does this mean that publishing a notice fulfills art. 14 requirements? Also note much processing occurs without the creation of a contract, such as ANPR cameras and soft pull for pre-approval. The point is that I should be told about these by the broker according to my reading. You do not say this reading is incorrect. | |
| Jan 25, 2022 at 15:46 | history | answered | amon | CC BY-SA 4.0 |