Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject:
Art. 14 GDPR: Information to be provided where personal data have not been obtained from the data subject
1: Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
[List of data to be provided]
5: Paragraphs 1 to 4 shall not apply where and insofar as:
(a) the data subject already has the information;
(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;
(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or
(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.
I have never received such a notice. I have recently submitted a Subject Access Request to my motor insurer, and as part of that they sent some data that the received from the Motor Insurance Database (MID) and Equifax. The Equifax data included policy numbers and dates over the last few years that I would have had access to at one point but to not know now, and the MID included three identifiers per row, two of which I have not seen before, and an encoded string that I am unable to decode but appears to encode data that I may have had access to. I have also used the internet, and as I understand it this involves a lot of passing around information about me between entities.
What exactly triggers the requirement for a data controller to inform the subject under Article 14?