Article 13.1 states:
Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
..and lists a lot of different information about the controller, DPO, processing purposes, the recipients etc.
Now, article 13.4 states:
Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.
My question, is: how do you know that the data subject already has the information? Do I have to store some proof of the data subject recieving / reading provided information? How should I know which part of the information data subject knows and which part is unknown to her/him?
What about people from whom I have not previously collected any personal data, but who may have already been informed about me as a data controller? For example, if I were the owner of a website that offers e-learning courses, can I assume, that someone who wants to sign up for the course, knows who I am, how to contact me and what is the purpose of the processing? It should be obvious for him/her. If he did not know it, he/she wouldn't sign up for the course on this particular website. After all, his/her decision to come to the website is not random - he/she chose it from many other websites offering courses. Can I omit information that, in my opinion, should be known to the customer at this point? Article 13.4 requires me to refrain from providing information to the data subject when the data subject has the information.