Artikel 13 📖 GDPR. Oplysningspligt ved indsamling af personoplysninger hos den registrerede

Artikel 13 GDPR. Oplysningspligt ved indsamling af personoplysninger hos den registrerede

Article 13 GDPR. Information to be provided where personal data are collected from the data subject

1. Hvis personoplysninger om en registreret indsamles hos den registrerede, giver den dataansvarlige på det tidspunkt, hvor personoplysningerne indsamles, den registrerede alle følgende oplysninger:

1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

Betragtning Sammenkædede tekster

Betragtning

(60) Principperne om rimelig og gennemsigtig behandling kræver, at den registrerede informeres om behandlingsaktiviteters eksistens og deres formål. Den dataansvarlige bør give den registrerede eventuelle yderligere oplysninger, der er nødvendige for at sikre en rimelig og gennemsigtig behandling, under hensyntagen til de specifikke omstændigheder og forhold, som personoplysningerne behandles under. Den registrerede bør desuden informeres om tilstedeværelse af profilering og konsekvenserne heraf. Hvis personoplysninger indsamles fra den registrerede, bør den registrerede også informeres om, hvorvidt den pågældende er forpligtet til at meddele personoplysningerne, og om konsekvenserne, hvis vedkommende ikke meddeler sådanne oplysninger. Denne information kan gives sammen med standardiserede ikoner med henblik på at give et meningsfuldt overblik over den planlagte behandling på en klart synlig, letlæselig og letforståelig måde. Hvis ikonerne præsenteres elektronisk, bør de være maskinlæsbare.

(60) The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed. Furthermore, the data subject should be informed of the existence of profiling and the consequences of such profiling. Where the personal data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the personal data and of the consequences, where he or she does not provide such data. That information may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing. Where the icons are presented electronically, they should be machine-readable.

Sammenkædede tekster

Article 29 Working Party Guidelines on transparency under Regulation 2016/679

Timing for provision of information

Articles 13 and 14 set out information which must be provided to the data subject at the commencement phase of the processing cycle. Article 13 applies to the scenario where the data is collected from the data subject. This includes personal data that: • a data subject consciously provides to a data controller (e.g. when completing an online form); or • a data controller collects from a data subject by observation (e.g. using automated data capturing devices or data capturing software such as cameras, network equipment, Wi-Fi tracking, RFID or other types of sensors). Article 14 applies in the scenario where the data have not been obtained from the data subject. This includes personal data which a data controller has obtained from sources such as: • third party data controllers; • publicly available sources; • data brokers; or • other data subjects.

a) identitet på og kontaktoplysninger for den dataansvarlige og dennes eventuelle repræsentant

(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2018):

This information should allow for easy identification of the controller and preferably allow for different forms of communications with the data controller (e.g. phone number, email, postal address etc.).

b) kontaktoplysninger for en eventuel databeskyttelsesrådgiver

(b) the contact details of the data protection officer, where applicable;

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on Data Protection Officers (DPOs) (2017):

The contact details of the DPO should include information allowing data subjects and the supervisory authorities to reach the DPO in an easy way (a postal address, a dedicated telephone number, and/or a dedicated e-mail address). When appropriate, for purposes of communications with the public, other means of communications could also be provided, for example, a dedicated hotline, or a dedicated contact form addressed to the DPO on the organisation’s website.

Article 37(7) does not require that the published contact details should include the name of the DPO. Whilst it may be a good practice to do so, it is for the controller or the processor and the DPO to decide whether this is necessary or helpful in the particular circumstances.

[…]

As a matter of good practice, the WP29 also recommends that an organisation informs its employees of the name and contact details of the DPO. For example, the name and contact details of the DPO could be published internally on organisation’s intranet, internal telephone directory, and organisational charts.

c) formålene med den behandling, som personoplysningerne skal bruges til, og retsgrundlaget for behandlingen

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2018):

In addition to setting out the purposes of the processing for which the personal data is intended, the relevant legal basis relied upon under Article 6 must be specified. In the case of special categories of personal data, the relevant provision of Article 9 (and where relevant, the applicable Union or Member State law under which the data is processed) should be specified. Where, pursuant to Article 10, personal data relating to criminal convictions and offences or related security measures based on Article 6.1 is processed, where applicable the relevant Union or Member State law under which the processing is carried out should be specified.

d) de legitime interesser, som forfølges af den dataansvarlige eller en tredjemand, hvis behandlingen er baseret på artikel 6, stk. 1, litra f)

(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

Retningslinjer & Case Law Sammenkædede tekster

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2016):

The specific interest in question must be identified for the benefit of the data subject. As a matter of best practice, the controller can also provide the data subject with the information from the balancing test, which must be carried out to allow reliance on Article 6.1(f) as a lawful basis for processing, in advance of any collection of data subjects’ personal data. To avoid information fatigue, this can be included within a layered privacy statement/ notice (see paragraph 35). In any case, the WP29 position is that information to the data subject should make it clear that they can obtain information on the balancing test upon request. This is essential for effective transparency where data subjects have doubts as to whether the balancing test has been carried out fairly or they wish to file a complaint with a supervisory authority.

Sammenkædede tekster

Artikel 6 GDPR. Lovlig behandling

Article 6 GDPR. Lawfulness of processing

[…]

1. Behandling er kun lovlig, hvis og i det omfang mindst ét af følgende forhold gør sig gældende:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

[…]

f) Behandling er nødvendig for, at den dataansvarlige eller en tredjemand kan forfølge en legitim interesse, medmindre den registreredes interesser eller grundlæggende rettigheder og frihedsrettigheder, der kræver beskyttelse af personoplysninger, går forud herfor, navnlig hvis den registrerede er et barn.

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

e) eventuelle modtagere eller kategorier af modtagere af personoplysningerne

(e) the recipients or categories of recipients of the personal data, if any;

Retningslinjer & Case Law Sammenkædede tekster

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2016):

The term “recipient” is defined in Article 4.9 as “a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not” [emphasis added]. As such, a recipient does not have to be a third party. Therefore, other data controllers, joint controllers and processors to whom data is transferred or disclosed are covered by the term “recipient” and information on such recipients should be provided in addition to information on third party recipients. The actual (named) recipients of the personal data, or the categories of recipients, must be provided. In accordance with the principle of fairness, controllers must provide information on the recipients that is most meaningful for data subjects. In practice, this will generally be the named recipients, so that data subjects know exactly who has their personal data. If controllers opt to provide the categories of recipients, the information should be as specific as possible by indicating the type of recipient (i.e. by reference to the activities it carries out), the industry, sector and sub-sector and the location of the recipients.

Sammenkædede tekster

Artikel 4 GDPR. Definitioner

Article 4 GDPR. Definitions

Definitioner

Definitions

[…]

9) »modtager«: en fysisk eller juridisk person, en offentlig myndighed, en institution eller et andet organ, hvortil personoplysninger videregives, uanset om det er en tredjemand eller ej. Offentlige myndigheder, som vil kunne få meddelt personoplysninger som led i en isoleret forespørgsel i henhold til EU-retten eller medlemsstaternes nationale ret, anses dog ikke for modtagere; de offentlige myndigheders behandling af disse oplysninger skal overholde de gældende databeskyttelsesregler afhængigt af formålet med behandlingen

(9) ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

[…]

f) hvor det er relevant, at den dataansvarlige agter at overføre personoplysninger til et tredjeland eller en international organisation, og om hvorvidt Kommissionen har truffet afgørelse om tilstrækkeligheden af beskyttelsesniveauet, eller i tilfælde af overførsler i henhold til artikel 46 eller 47 eller artikel 49, stk. 1, andet afsnit, litra h), henvisning til de fornødne eller passende garantier, og hvordan der kan fås en kopi heraf, eller hvor de er blevet gjort tilgængelige.

(f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

Retningslinjer & Case Law Sammenkædede tekster

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2016):

The relevant GDPR article permitting the transfer and the corresponding mechanism (e.g. adequacy decision under Article 45/ binding corporate rules under Article 47/ standard data protection clauses under Article 46.2/ derogations and safeguards under Article 49 etc.) should be specified. Information on where and how the relevant document may be accessed or obtained should also be provided e.g. by providing a link to the mechanism used. In accordance with the principle of fairness, the information provided on transfers to third countries should be as meaningful as possible to data subjects; this will generally mean that the third countries be named.

Sammenkædede tekster

Artikel 45 GDPR. Overførsler baseret på en afgørelse om tilstrækkeligheden af beskyttelsesniveauet

Article 45 GDPR. Transfers on the basis of an adequacy decision

Artikel 47 GDPR. Bindende virksomhedsregler

Article 47 GDPR. Binding corporate rules

Artikel 46 GDPR. Overførsler omfattet af fornødne garantier

Article 46 GDPR. Transfers subject to appropriate safeguards

[…]

2. De fornødne garantier i stk. 1 kan uden krav om specifik godkendelse fra en tilsynsmyndighed sikres gennem:

2. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:

b) bindende virksomhedsregler i overensstemmelse med artikel 47

(b) binding corporate rules in accordance with Article 47;

c) standardbestemmelser om databeskyttelse vedtaget af Kommissionen efter undersøgelsesproceduren i artikel 93, stk. 2

(c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);

[…]

Artikel 49 GDPR. Undtagelser i særlige situationer

Article 49 GDPR. Derogations for specific situations

1. I mangel af en afgørelse om tilstrækkeligheden af beskyttelsesniveauet i henhold til artikel 45, stk. 3, eller fornødne garantier i henhold til artikel 46, herunder bindende virksomhedsregler, må en overførsel eller flere overførsler af personoplysninger til et tredjeland eller en international organisation kun finde sted på en af følgende betingelser:

1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

[…]

Hvis overførsel ikke kan have hjemmel i en bestemmelse i artikel 45 eller 46, herunder bestemmelserne om bindende virksomhedsregler, og ingen af undtagelserne i særlige situationer omhandlet i dette stykkes første afsnit finder anvendelse, må en videregivelse til et tredjeland eller en international organisation kun finde sted, hvis overførslen ikke gentages, kun vedrører et begrænset antal registrerede, er nødvendig af hensyn til vægtige legitime interesser, som forfølges af den dataansvarlige, den registreredes interesser eller rettigheder og frihedsrettigheder ikke går forud for disse interesser, og den dataansvarlige har vurderet alle omstændigheder i forbindelse med overførslen og på grundlag af denne vurdering giver passende garantier for beskyttelse af personoplysningerne. Den dataansvarlige underretter tilsynsmyndigheden om overførslen. Ud over oplysningerne i artikel 13 og 14 underretter den dataansvarlige den registrerede om overførslen og om de vægtige legitime interesser, der forfølges.

Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall inform the supervisory authority of the transfer. The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued.

[…]

2. Ud over de oplysninger, der er omhandlet i stk. 1, giver den dataansvarlige på det tidspunkt, hvor personoplysningerne indsamles, den registrerede følgende yderligere oplysninger, der er nødvendige for at sikre en rimelig og gennemsigtig behandling:

2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:

Betragtning Sammenkædede tekster

Betragtning

(61) Oplysninger om behandling af personoplysninger bør gives til den registrerede på tidspunktet for indsamlingen fra den registrerede, eller hvis personoplysningerne indhentes fra en anden kilde, inden for en rimelig periode afhængigt af de konkrete omstændigheder. Hvis personoplysninger lovligt kan videregives til en anden modtager, bør den registrerede informeres, når personoplysningerne første gang videregives til modtageren. Hvis den dataansvarlige agter at behandle personoplysningerne til et andet formål end det, hvortil de er indsamlet, bør den dataansvarlige forud for denne viderebehandling give den registrerede oplysninger om dette andet formål og andre nødvendige oplysninger. Hvis den registrerede ikke kan informeres om personoplysningernes oprindelse, fordi der er anvendt forskellige kilder, bør der gives generelle oplysninger.

(61) The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data are obtained from another source, within a reasonable period, depending on the circumstances of the case. Where personal data can be legitimately disclosed to another recipient, the data subject should be informed when the personal data are first disclosed to the recipient. Where the controller intends to process the personal data for a purpose other than that for which they were collected, the controller should provide the data subject prior to that further processing with information on that other purpose and other necessary information. Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided.

Sammenkædede tekster

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0.

3.1 Transparency [24]

_{[24]Elaboration on how to understand the concept of transparency can be found in Article 29 Working Party. “Guidelines on transparency under Regulation 2016/679”. WP 260 rev.01, 11 April 2018. ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=51025 – endorsed by the EDPB}

65. The controller must be clear and open with the data subject about how they will collect, use and share personal data. Transparency is about enabling data subjects to understand, and if necessary, make use of their rights in Articles 15 to 22. The principle is embedded in Articles 12, 13, 14 and 34. Measures and safeguards put in place to support the principle of transparency should also support the implementation of these Articles.

66. Key design and default elements for the principle of transparency may include:

•Clarity – Information shall be in clear and plain language, concise and intelligible.

•Semantics – Communication should have a clear meaning to the audience in question.

•Accessibility – Information shall be easily accessible for the data subject.

•Contextual – Information should be provided at the relevant time and in the appropriate form.

•Relevance – Information should be relevant and applicable to the specific data subject.

•Universal design – Information shall be accessible to all data subjects, include use of machine readable languages to facilitate and automate readability and clarity.

•Comprehensible – Data subjects should have a fair understanding of what they can expect with regards to the processing of their personal data, particularly when the data subjects are children or other vulnerable groups.

• Multi-channel – Information should be provided in different channels and media, not only the textual, to increase the probability for the information to effectively reach the data subject.

• Layered – The information should be layered in a manner that resolves the tension between completeness and understanding, while accounting for data subjects’ reasonable expectations.

a) det tidsrum, hvor personoplysningerne vil blive opbevaret, eller hvis dette ikke er muligt, de kriterier, der anvendes til at fastlægge dette tidsrum

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

ISO 27701 Retningslinjer & Case Law

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 13(2)(a) GDPR:

7.4.7 Retention

Control

The organization should not retain PII for longer than is necessary for the purposes for which the PII is processed.

Implementation guidance

The organization should develop and maintain retention schedules for information it retains, taking into account the requirement to retain PII for no longer than is necessary.

(EN) […]

(EN) Sign in
to read the full text

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2016):

This is linked to the data minimisation requirement in Article 5.1(c) and storage limitation requirement in Article 5.1(e). The storage period (or criteria to determine it) may be dictated by factors such as statutory requirements or industry guidelines but should be phrased in a way that allows the data subject to assess, on the basis of his or her own situation, what the retention period will be for specific data/ purposes. It is not sufficient for the data controller to generically state that personal data will be kept as long as necessary for the legitimate purposes of the processing. Where relevant, the different storage periods should be stipulated for different categories of personal data and/or different processing purposes, including where appropriate, archiving periods.

EDPB, Guidelines on the use of location data and contact tracing tools in the context of the COVID-19 outbreak (2020):

Storage limitation should consider the true needs and the medical relevance (this may include epidemiology-motivated considerations like the incubation period,etc.) and personal data should be kept only for the duration of the COVID-19 crisis. Afterwards,as a general rule,all personal data should be erased or anonymised.

b) retten til at anmode den dataansvarlige om indsigt i og berigtigelse eller sletning af personoplysninger eller begrænsning af behandling vedrørende den registrerede eller til at gøre indsigelse mod behandling samt retten til dataportabilitet

(b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

ISO 27701 Retningslinjer & Case Law

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 13(2)(b) GDPR:

7.3.5 Providing mechanism to object to PII processing

Control

The organization should provide a mechanism for PII principals to object to the processing of their PII.

Implementation guidance

Some jurisdictions provide PII principals with a right to object to the processing of their PII. Organizations subject to the legislation and/or regulation of such jurisdictions should ensure that they implement appropriate measures to enable PII principals to exercize this right.

(EN) […]

(EN) Sign in
to read the full text

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2016):

This information should be specific to the processing scenario and include a summary of what the right involves and how the data subject can take steps to exercise it and any limitations on the right. […] In particular, the right to object to processing must be explicitly brought to the data subject’s attention at the latest at the time of first communication with the data subject and must be presented clearly and separately from any other information.64 In relation to the right to portability, see WP29 Guidelines on the right to data portability.

c) når behandling er baseret på artikel 6, stk. 1, litra a), eller artikel 9, stk. 2, litra a), retten til at trække samtykke tilbage på ethvert tidspunkt, uden at dette berører lovligheden af behandling, der er baseret på samtykke, inden tilbagetrækning heraf

(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

ISO 27701 Retningslinjer & Case Law Sammenkædede tekster

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 13(2)(c) GDPR:

7.3.4 Providing mechanism to modify or withdraw consent

Control

The organization should provide a mechanism for PII principals to modify or withdraw their consent.

Implementation guidance

The organization should inform PII principals of their rights related to withdrawing consent (which may vary by jurisdiction) at any time, and provide the mechanism to do so.

(EN) […]

(EN) Sign in
to read the full text

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2016):

This information should include how consent may be withdrawn, taking into account that it should be as easy for a data subject to withdraw consent as to give it.

Sammenkædede tekster

Artikel 6 GDPR. Lovlig behandling

Article 6 GDPR. Lawfulness of processing

Lovlig behandling

Lawfulness of processing

1. Behandling er kun lovlig, hvis og i det omfang mindst ét af følgende forhold gør sig gældende:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

a) Den registrerede har givet samtykke til behandling af sine personoplysninger til et eller flere specifikke formål.

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

[…]

Artikel 9 GDPR. Behandling af særlige kategorier af personoplysninger

Article 9 GDPR. Processing of special categories of personal data

Behandling af særlige kategorier af personoplysninger

Processing of special categories of personal data

1. Behandling af personoplysninger om race eller etnisk oprindelse, politisk, religiøs eller filosofisk overbevisning eller fagforeningsmæssigt tilhørsforhold samt behandling af genetiske data, biometriske data med det formål entydigt at identificere en fysisk person, helbredsoplysninger eller oplysninger om en fysisk persons seksuelle forhold eller seksuelle orientering er forbudt.

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2. Stk. 1 finder ikke anvendelse, hvis et af følgende forhold gør sig gældende:

2. Paragraph 1 shall not apply if one of the following applies:

a) Den registrerede har givet udtrykkeligt samtykke til behandling af sådanne personoplysninger til et eller flere specifikke formål, medmindre det i EU-retten eller medlemsstaternes nationale ret er fastsat, at det i stk. 1 omhandlede forbud ikke kan hæves ved den registreredes samtykke.

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

[…]

Artikel 7 GDPR. Betingelser for samtykke

Article 7 GDPR. Conditions for consent

Betingelser for samtykke

Conditions for consent

[…]

3. Den registrerede har til enhver tid ret til at trække sit samtykke tilbage. Tilbagetrækning af samtykke berører ikke lovligheden af den behandling, der er baseret på samtykke inden tilbagetrækningen. Inden der gives samtykke, skal den registrerede oplyses om, at samtykket kan trækkes tilbage. Det skal være lige så let at trække sit samtykke tilbage som at give det.

3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

[…]

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0.

3.2 Lawfulness

67. The controller must identify a valid legal basis for the processing of personal data. Measures and safeguards should support the requirement to make sure that the whole processing lifecycle is in line with the relevant legal grounds of processing.

d) retten til at indgive en klage til en tilsynsmyndighed

(d) the right to lodge a complaint with a supervisory authority;

Retningslinjer & Case Law Sammenkædede tekster

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2016):

This information should explain that, in accordance with Article 77, a data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or of an alleged infringement of the GDPR.

Sammenkædede tekster

Artikel 77 GDPR. Ret til at indgive klage til en tilsynsmyndighed

Article 77 GDPR. Right to lodge a complaint with a supervisory authority

Ret til at indgive klage til en tilsynsmyndighed

Right to lodge a complaint with a supervisory authority

1. Uden at det berører andre administrative klageadgange eller adgang til retsmidler, har enhver registreret ret til at indgive klage til en tilsynsmyndighed, navnlig i den medlemsstat, hvor vedkommende har sit sædvanlige opholdssted eller sit arbejdssted, eller hvor den påståede overtrædelse har fundet sted, hvis den registrerede finder, at behandlingen af personoplysninger vedrørende vedkommende overtræder denne forordning.

1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

2. Den tilsynsmyndighed, som klagen er indgivet til, underretter klageren om forløbet og resultatet af klagen, herunder om muligheden for anvendelse af retsmidler, jf. artikel 78.

2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.

e) om meddelelse af personoplysninger er lovpligtigt eller et krav i henhold til en kontrakt eller et krav, der skal være opfyldt for at indgå en kontrakt, samt om den registrerede har pligt til at give personoplysningerne og de eventuelle konsekvenser af ikke at give sådanne oplysninger

(e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on transparency under Regulation 2016/679, WP260 rev.01 (2016):

For example in an employment context, it may be a contractual requirement to provide certain information to a current or prospective employer. Online forms should clearly identify which fields are “required”, which are not, and what will be the consequences of not filling in the required fields.

f) forekomsten af automatiske afgørelser, herunder profilering, som omhandlet i artikel 22, stk. 1 og 4, og i disse tilfælde som minimum meningsfulde oplysninger om logikken heri samt betydningen og de forventede konsekvenser af en sådan behandling for den registrerede.

(f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

ISO 27701 Retningslinjer & Case Law Sammenkædede tekster

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 13(2)(f) GDPR:

7.3.10 Automated decision making

Control

The organization should identify and address obligations, including legal obligations, to the PII principals resulting from decisions made by the organization which are related to the PII principal based solely on automated processing of PII.

(EN) […]

(EN) Sign in
to read the full text

Retningslinjer & Case Law

(EN) Article 29 Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (wp251rev.01) (2018):

Given the core principle of transparency underpinning the GDPR, controllers must ensure they explain clearly and simply to individuals how the profiling or automated decision-making process works.
In particular, where the processing involves profiling-based decision making (irrespective of whether it is caught by Article 22 provisions), then the fact that the processing is for the purposes of both (a) profiling and (b) making a decision based on the profile generated, must be made clear to the data subject.

Recital 60 states that giving information about profiling is part of the controller’s transparency obligations under Article 5(1) (a). The data subject has a right to be informed by the controller about and, in certain circumstances, a right to object to ‘profiling’, regardless of whether solely automated individual decision-making based on profiling takes place.

EDPB, Guidelines 8/2020 on the targeting of social media users (2020).

Sammenkædede tekster

Artikel 22 GDPR. Automatiske individuelle afgørelser, herunder profilering

Article 22 GDPR. Automated individual decision-making, including profiling

1. Den registrerede har ret til ikke at være genstand for en afgørelse, der alene er baseret på automatisk behandling, herunder profilering, som har retsvirkning eller på tilsvarende vis betydeligt påvirker den pågældende.

1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

[…]

4. De afgørelser, der er omhandlet i stk. 2, må ikke baseres på særlige kategorier af personoplysninger, jf. artikel 9, stk. 1, medmindre artikel 9, stk. 2, litra a) eller g), finder anvendelse, og der er indført passende foranstaltninger til beskyttelse af den registreredes rettigheder og frihedsrettigheder samt legitime interesser.

4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.

3. Hvis den dataansvarlige agter at viderebehandle personoplysningerne til et andet formål end det, hvortil de er indsamlet, giver den dataansvarlige forud for denne viderebehandling den registrerede oplysninger om dette andet formål og andre relevante yderligere oplysninger, jf. stk. 2.

3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 13(3) GDPR:

7.3.3 Providing information to PII principals

Control

The organization should provide PII principals with clear and easily accessible information identifying the PII controller and describing the processing of their PII.

Implementation guidance

The organization should provide the information detailed in 7.3.2 to PII principals in a timely, concise, complete, transparent, intelligible and easily accessible form, using clear and plain language, as appropriate to the target audience.

(EN) […]

(EN) Sign in
to read the full text

4. Stk. 1, 2 og 3 finder ikke anvendelse, hvis og i det omfang den registrerede allerede er bekendt med oplysningerne.

4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

Generel forordning om databeskyttelse (GDPR)

General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

Ekspertkommentar ISO 27701 Betragtning Retningslinjer & Case Law Efterlad en kommentar

Ekspertkommentar

(EN) To facilitate the work of our consultants, we have collected all the requirements and information that have to be mentioned and created a convenient checklist. Next to each paragraph, we have placed links to specific GDPR articles and guidelines. We grouped all the information into 7 sections:

Controller’s identity
Purpose and lawful basis for processing
Personal data
Transfers of data to third countries
Rights
Changes (in privacy notices)
Form (of information provided)

It looks like this:

(EN) […]

(EN) Sign in
to read the full text

(EN) Author

(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP

(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant

(EN) Ask a question

(EN)

Data Subject Request Letter Sample

Concern: Request of information regarding my personal data

Dear Madam, Dear Sir,

I have a right to be informed, under Article 13 of the General Data Protection Regulation (GDPR), about personal data concerning me that you are processing…

(EN) […]

(EN) Sign in
to read the full text

(EN) Author

(EN) Louis-Philippe Gratton PhD, LLM

(EN) Privacy Expert

(EN) Ask a question

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 13 GDPR:

7.3.2 Determining information for PII principals

Control

The organization should determine and document the information to be provided to PII principals regarding the processing of their PII and the timing of such a provision.

Implementation guidance

The organization should determine the legal, regulatory and/or business requirements for when information is to be provided to the PII principal (e.g. prior to processing, within a certain time from when it is requested, etc.) and for the type of information to be provided.

(EN) […]

(EN) Sign in
to read the full text

Betragtning

(62) Det er imidlertid ikke nødvendigt at pålægge forpligtelsen til at give information, hvis den registrerede allerede er bekendt med oplysningerne, hvis registrering eller videregivelse af personoplysningerne udtrykkelig er fastsat ved lov, eller hvis det viser sig at være umuligt eller vil kræve en uforholdsmæssigt stor indsats at underrette den registrerede. Sidstnævnte kan navnlig være tilfældet i forbindelse med behandling til arkivformål i samfundets interesse, til videnskabelige eller historiske forskningsformål eller til statistiske formål. I denne forbindelse bør der tages hensyn til antallet af registrerede, oplysningernes alder og eventuelle fornødne garantier, der er stillet.

(62) However, it is not necessary to impose the obligation to provide information where the data subject already possesses the information, where the recording or disclosure of the personal data is expressly laid down by law or where the provision of information to the data subject proves to be impossible or would involve a disproportionate effort. The latter could in particular be the case where processing is carried out for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. In that regard, the number of data subjects, the age of the data and any appropriate safeguards adopted should be taken into consideration.

(63) En registreret bør have ret til indsigt i personoplysninger, der er indsamlet om vedkommende, og til let og med rimelige mellemrum at udøve denne ret med henblik på at forvisse sig om og kontrollere en behandlings lovlighed. Dette omfatter registreredes ret til indsigt i deres helbredsoplysninger, f.eks. data i deres lægejournaler om diagnoser, undersøgelsesresultater, lægelige vurderinger samt enhver behandling og ethvert indgreb, der er foretaget. Enhver registreret bør derfor have ret til at kende og blive underrettet om navnlig de formål, hvortil personoplysningerne behandles, om muligt perioden, hvor personoplysningerne behandles, modtagerne af personoplysningerne, logikken der ligger bag en automatisk behandling af personoplysninger, og om konsekvenserne af sådan behandling, i hvert fald når den er baseret på profilering. Hvis det er muligt, bør den dataansvarlige kunne give fjernadgang til et sikkert system, der giver den registrerede direkte adgang til vedkommendes personoplysninger. Denne ret bør ikke krænke andres rettigheder eller frihedsrettigheder, herunder forretningshemmeligheder eller intellektuel ejendomsret, navnlig den ophavsret, som programmerne er beskyttet af. Denne vurdering bør dog ikke resultere i en afvisning af at give al information til den registrerede. Hvis den dataansvarlige behandler en stor mængde oplysninger om den registrerede, bør den dataansvarlige kunne anmode om, at den registrerede, inden informationen gives, præciserer den information eller de behandlingsaktiviteter, som anmodningen vedrører.

(63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates.

Retningslinjer & Case Law

(EN)