What exactly triggers the GDPR Article 14?

Question

Article 14 of the GDPR concerns the requirement for a data controller to inform the data subject when they obtain personal data has been obtained from an entity that is not the data subject:

Art. 14 GDPR: Information to be provided where personal data have not been obtained from the data subject

1: Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

[List of data to be provided]

5: Paragraphs 1 to 4 shall not apply where and insofar as:

(a) the data subject already has the information;

(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;

(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or

(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.

I have never received such a notice. I have recently submitted a Subject Access Request to my motor insurer, and as part of that they sent some data that the received from the Motor Insurance Database (MID) and Equifax. The Equifax data included policy numbers and dates over the last few years that I would have had access to at one point but to not know now, and the MID included three identifiers per row, two of which I have not seen before, and an encoded string that I am unable to decode but appears to encode data that I may have had access to. I have also used the internet, and as I understand it this involves a lot of passing around information about me between entities.

What exactly triggers the requirement for a data controller to inform the subject under Article 14?

Answer 1

Simply put, Art 14 GDPR is often ignored. But also, it triggers less often than some might think.

While Art 14 applies whenever the data controller processes personal data that weren't obtained (directly) from the data subject (see Art 14(1)), there are a bunch of exceptions to the notification obligation, such as Art 14(5)(a): no notification is necessary if the data subject already has the information in the Art 14 privacy notice.

For example, your motor insurer likely fulfilled its transparency obligations under Art 14 together with its Art 13 transparency obligations by providing a privacy notice when you signed up to your service, and making updated versions available subsequently. While a privacy notice must be “provided”, it is not required to force you to actually read and comprehend this document. And it is not necessarily required to specifically notify you about Art 14 processing if you were already provided this information in a privacy notice.

However, “providing” the information implies a more active approach than merely making the privacy notice easily available on a website. The ICO says that data controllers “must proactively make individuals aware of this information and […] need to give them an easy way to access it”.

The lack of notification from the MID or from Equifax must be viewed critically, but it could technically be that they are compliant if you were notified about their privacy notices by the data sources.

So this approach would be clearly compliant:

• You open a bank account.
• The bank provides its own privacy notice per Art 13 GDPR.
• The bank sends data to Equifax.
• Equifax notifies you about their processing per Art 14 GDPR.

But so would this:

• You open a bank account.
• The bank provides its own privacy notice per Art 13 GDPR.
• The bank notifies you about Equifax' processing per Art 14 GDPR.
• The bank sends data to Equifax, noting that they've already notified you.

There are of course some exceptions in Art 14(5), in particular that notification can be skipped if it would entail “disproportionate effort”. There was a high-profile case about this in Poland:

• A data controller had collected data from public registries, affecting an estimated 6 million data subjects. The data included contact information such as addresses, phone numbers, emails.
• The data controller did notify those people for which they had an email address (about 90 000 people, about 1.5%).
• The data controller did not notify other data subjects, citing high costs for sending letters.
• The Polish UODO (corresponds to the UK ICO) found that this wasn't disproportionate effort, and that the data controller failed to meet its Art 14 obligations.
• If I remember correctly, the data controller decided to destroy the collected data instead of sending out notifications.

A roughly similar UK case was the ICO's 7.5M GBP fine against Clearview, though there the breach of transparency obligations was just one of many problems.