1

Article 13.1 states:

Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

..and lists a lot of different information about the controller, DPO, processing purposes, the recipients etc.

Now, article 13.4 states:

Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

My question, is: how do you know that the data subject already has the information? Do I have to store some proof of the data subject recieving / reading provided information? How should I know which part of the information data subject knows and which part is unknown to her/him?

EDIT:

What about people from whom I have not previously collected any personal data, but who may have already been informed about me as a data controller? For example, if I were the owner of a website that offers e-learning courses, can I assume, that someone who wants to sign up for the course, knows who I am, how to contact me and what is the purpose of the processing? It should be obvious for him/her. If he did not know it, he/she wouldn't sign up for the course on this particular website. After all, his/her decision to come to the website is not random - he/she chose it from many other websites offering courses. Can I omit information that, in my opinion, should be known to the customer at this point? Article 13.4 requires me to refrain from providing information to the data subject when the data subject has the information.

  • Art. 13(4) does not require you to limit the information. It just allows you to limit the information. If you want to provide all information each time, that is perfectly fine. See also recitals 62: However, it is not necessary to impose the obligation to provide information where the data subject already possesses the information [...] – wimh Oct 22 '18 at 21:13
  • @wimh, I disagree, Art 13.4 does require limiting information. It may be unclear in the English translation due to the use of "shall", but in the Polish translation (my native language) there is clearly a requirement. Recital 62 is not unambiguous, it is only a general explanation. And it suits both the understanding of Article 13.4 as requiring and as allowing. – Grzegorz Adam Kowalski Oct 23 '18 at 8:56
  • 1
    In that case you have to wait how Art. 13(4) is interpreted by the courts. I also read the German and Dutch version, both are very clear not a requirement. The text "shall not apply" appears also on other places, like in Art. 9 and Art. 22. Maybe you can check how that is translated. But I have to add that English is not my native language either, so I better leave the interpretation of the English version to someone else. – wimh Oct 23 '18 at 11:56
1

You know because you know, that is, you have a means of knowing unequivocally that the subject has previously received that information. For example, you know you gave it to them.

  • What about people from whom I have not previously collected any personal data, but who may have already been informed about me as a data controller? – Grzegorz Adam Kowalski Oct 22 '18 at 8:32
  • For example, if I were the owner of a website that offers e-learning courses, can I assume, that someone who wants to sign up for the course, knows who I am, how to contact me and what is the purpose of the processing? It should be obvious for him/her. If he did not know it, he/she wouldn't sign up for the course on this particular website. After all, his/her decision to come to the website not random. – Grzegorz Adam Kowalski Oct 22 '18 at 8:32
  • Can I omit information that, in my opinion, should be known to the customer? Article 13.4 requires me to limit the excess of information only to those that the customer does not have. – Grzegorz Adam Kowalski Oct 22 '18 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.