European Data Protection: Law and Practice

Eduardo Ustaran

Chapter 8 – Information Provision Obligations – Hannah Jackson, CIPP/E

Providing information when At what time Article

Data is collected from the data At the time data is obtained. 13
subject
Data is collected from an other - within a reasonable period, at the latest within 14
source one month; or
- at the first communication with the subject; or
- when disclosed to another recipient.
Data subjects rights At the first communication with the subject. The 15
subject has to be informed about the right to
withdraw consent before he or she has giving
consent.

Data subjects have the right to object to the

processing when the processing is conducted on
the basis of the controllers legitimate interests
or for a task carried out in the public interest
and for the purpose of direct marketing. This
information has to be brought to the attention.
Clear and separate from other information.
International data transfers Data subjects must be informed of transfers to a 47/49
third country, on basis of:
- the controllers legitimate interests; this interest
must be provided
- consent; the risks must be provided
- Binding Corporate Rules; data subjects must
be informed about the arrangement.
New purposes of processing Before the new processing commences. 13/14
Multiple controllers Information about the arrangement and 13/14
responsibilities of parties has to be made
available to subjects. On request? Unclear.
Personal data breaches Without undue delay (where applicable). 34

This schedule is part of the CIPP/E online training program. Train smart and register for our e-learning at CIPPTraining.com