Is there any explanation as to why restaurants usually don't provide these information?
I imagine it's mostly because it doesn't occur to the restauranteur, instead of a decision based on legal advice/understanding.
However, one of the following could be true:
- they might not be in fact obliged to provide the information
- they might believe or are advised in their circumstances there is little risk if they don't provide the information
- they might believe or are advised that in the circumstances they aren't obliged to provide the information
As indicated by Article 13.4 and Recital 62, referred to in a footnote, there may be circumstances in which it's not in fact obligatory to provide all that information.
Some of the items in Article 13 are irrelevant/inapplicable to many restaurants - e.g. a typical non-chain, local restaurant, which doesn't share the reservation data with other organisations, or transfer the data to a third country with/without an Adequacy Decision, or do data analysis on its customers data, etc.
Article 13.4 says:
Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.
Recital 62, which as a 'recital' is not legally binding but may be used to interpret the law, says in part (my bullets for clarity, and my emphasis):
- it is not necessary to impose the obligation to provide information where the data subject already possesses the information
- where the recording or disclosure of the personal data is expressly laid down by law
- where the provision of information to the data subject proves to be impossible or would involve a disproportionate effort.
If you imagine an in-person or phone reservation, to provide all that information listed in Article 13, by phone or in person, solely to record that Alice wants to reserve a table for two on Saturday at 8pm, might be considered a disproportionate effort (not to mention tedious to the customer).
On the other hand, in terms of online reservations there's no significant effort having a privacy policy page and linking to it from the reservation page. Some restaurants outsource or link their reservation system to third-party online software, which ought to have a privacy policy already.
The larger, 'more sophisticated' operations, large chain restaurants, analysing their customers data and using loyalty schemes and such, would be advised to pay far more attention to their GDPR obligations.
Incidentally, it's not just restaurants that don't provide this Article 13 information by phone - I'm not aware of any large, more 'sophisticated' businesses, that must pay far more attention to GDPR, e.g. those in the B2C finance sector, that provide this information by phone either. In finance there is some regulatory messaging that must be stated (whether by person or machine) but not reams of it (and many customers don't want to hear it, even on freephone lines, they just want to speak to someone who can assist them).
I'd be surprised if there were any business that repeats the information verbatim by phone or in person instead of directing the person to a webpage or leaflet.
If it is disproportionate for a school "to write to every emergency contact to provide them with privacy information" (UK's Information Commissoner's Office guidance) then it seems disproportionate for a waiter to provide this when you make a reservation by phone or in person.
Likewise, "Given the very large volume of patients passing through the [hypothetical] hospital on a daily basis, it would involve disproportionate effort on the part of the hospital to provide all persons who have been listed as next-of-kin on forms filled in by patients each day with the information required under Article 14" (Article 29 Working Party Guidelines on transparency under Regulation 2016/679).
The hospital example refers to Article 14 but it would seem to be relevant to Article 13 too.
That said, the waiter should be able to direct the customer to a privacy policy if asked, and the organisation is supposed to assess and document the reasons for its decisions about Article 13.
I'd add that you are free to give restaurants a pseudonym and some restaurants don't ask for your phone number.
Article 13 "GDPR Information to be provided where personal data are collected from the data subject"
- Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;
(b) the contact details of the data protection officer, where applicable;
It is likely an individual restaurant is exempt from the obligation to appoint a data protection officer. See Article 37, "Designation of the data protection officer". An individual restaurant is unlikely to have "core activities" of "processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale" or "a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10."
A large chain of restaurants might do that kind of activity, particularly if it operates a loyalty scheme or such across the brand. For example, McDonald's, Costa, Burger King, Pizza Express and Nando's run loyalty schemes with large numbers of registered customers - McDonald's has some 100 million.
(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
(e) the recipients or categories of recipients of the personal data, if any;
(f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
Transfer to third country - inapplicable to many restaurants, particularly in terms of their table reservations.
- In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
(b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
(d) the right to lodge a complaint with a supervisory authority;
(e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
(f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Automated decision-making based on personal data is not done by a typical restaurant.
- Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.
Inapplicable to a typical restaurant, which takes the name and possibly phone number for a reservation and does nothing else with that data (apart from eventually disposing of it).
- Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.
To some extent the data subject does already have the information, although it might not count for the purpose of Article 13.4 because it is not explicitly stated and they might not "know" it in the context of GDPR.
The UK's ICO says (my emphasis), "If you know, or it's obvious, that an individual already has some of the necessary information, you do not need to provide it to them." (I don't think the EU has or interprets "or it's obvious".)
In particular, the purpose of processing the customer's name and possibly phone number should be obvious to the customer because that customer initiated the request for the table reservation, it's self-explanatory and an ordinary, 'everyday' event. In contrast, it's not always obvious when you're being monitored by CCTV in a shop or by hundreds of tracking scripts on a website.
Of course, if the name and phone number are processed for other purposes than the table reservation, such as marketing messages, the restaurant must have a lawful basis for doing it and tell the customer about it.
I can find a number of publicised enforced complaints based on Article 13 (search for Article 13 or filter the Type column for "Insufficient fulfilment of information obligations"). It seems the only ones about restaurants pertain to video surveillance being used with no notices containing the required information or directing people to where it can be found. This also seems to be the case from my 'randomly' selecting a number of complaints about 'store owner' and the one 'hotel owner'.
