Artikolu 14 📖 RĠPD (GDPR). Informazzjoni li għandha tiġi pprovduta fejn id-data personali ma tkunx inkisbet mis-suġġett tad-data

Artikolu 14 RĠPD (GDPR). Informazzjoni li għandha tiġi pprovduta fejn id-data personali ma tkunx inkisbet mis-suġġett tad-data

Article 14 GDPR. Information to be provided where personal data have not been obtained from the data subject

1. Fejn ma tkunx inkisbet data personali mis-suġġett tad-data, il-kontrollur għandu jipprovdi lis-suġġett tad-data l-informazzjoni li ġejja:

1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

(a) l-identità u d-dettalji ta’ kuntatt tal-kontrollur u, fejn applikabbli, tar-rappreżentant tal-kontrollur;

(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;

(b) id-dettalji ta’ kuntatt tal-uffiċjal tal-protezzjoni tad-data, fejn applikabbli;

(b) the contact details of the data protection officer, where applicable;

(c) l-għanijiet tal-ipproċessar li għalihom hija maħsuba d-data personali kif ukoll il-bażi legali għall-ipproċessar;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) il-kategoriji ta’ data personali inkwistjoni;

(d) the categories of personal data concerned;

(e) ir-riċevituri jew il-kategoriji ta’ riċevituri tad-data personali, jekk jeżistu;

(e) the recipients or categories of recipients of the personal data, if any;

(f) fejn applikabbli, il-fatt li l-kontrollur għandu l-ħsieb li jittrasferixxi data personali lil riċevitur f’pajjiż terz jew organizzazzjoni internazzjonali u l-eżistenza jew l-assenza ta’ deċiżjoni ta’ adegwatezza mill-Kummissjoni, jew fil-każ ta’ trasferimenti msemmija fl-Artikolu 46 jew 47, jew it-tieni subparagrafu tal-Artikolu 49(1), referenza għas-salvagwardji xierqa jew adatti u l-mezzi biex tinkiseb kopja tagħhom jew fejn dawn ikunu saru disponibbli;

(f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.

Testi relatati

Artikolu 46 RĠPD (GDPR). Trasferimenti soġġetti għal salvagwardji xierqa

Article 46 GDPR. Transfers subject to appropriate safeguards

Artikolu 47 RĠPD (GDPR). Regoli korporattivi vinkolanti

Article 47 GDPR. Binding corporate rules

Artikolu 49 RĠPD (GDPR). Derogi għal sitwazzjonijiet speċifiċi

Article 49 GDPR. Derogations for specific situations

1. Fin-nuqqas ta’ deċiżjoni dwar l-adegwatezza skont l-Artikolu 45(3), jew salvagwardji xierqa skont l-Artikolu 46, inklużi regoli korporattivi vinkolanti, trasferiment jew sett ta’ trasferimenti ta’ data personali lejn pajjiż terz jew organizzazzjoni internazzjonali għandu jseħħ biss b’waħda mill-kondizzjonijiet li ġejjin:

1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

[…]

Fejn trasferiment ma setgħax ikun ibbażat fuq dispożizzjoni fl-Artikoli 45 jew 46, inklużi d-dispożizzjonijiet dwar regoli korporattivi vinkolanti, u l-ebda waħda mid-derogi għal sitwazzjoni speċifika msemmija fl-ewwel subparagrafu ta’ dan il-paragrafu ma tkun applikabbli, it-trasferiment ma jkunx ripetittiv, jikkonċerna biss għadd limitat ta’ suġġetti tad-data, ikun meħtieġ għall-għanijiet ta’ interessi leġittimi konvinċenti mfittxija mill-kontrollur li ma jingħelbux mill-interessi jew id-drittijiet u l-libertajiet tas-suġġett tad-data, u l-kontrollur ikun ivvaluta ċ-ċirkostanzi kollha madwar it-trasferiment tad-data u abbażi ta’ dik il-valutazzjoni pprovda salvagwardji xierqa fir-rigward tal-protezzjoni tad-data personali. Il-kontrollur għandu jinforma lill-awtorità superviżorja bit-trasferiment. Il-kontrollur għandu, barra milli jipprovdi l-informazzjoni msemmija fl-Artikolu 13 u 14, jinforma lis-suġġett tad-data dwar it-trasferiment u dwar l-interessi leġittimi konvinċenti segwiti.

Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall inform the supervisory authority of the transfer. The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued.

[…]

2. Minbarra l-informazzjoni msemmija fil-paragrafu 1, il-kontrollur għandu jipprovdi lis-suġġett tad-data l-informazzjoni li ġejja li tkun meħtieġa biex jiġi żgurat pproċessar ġust u trasparenti fir-rigward tas-suġġett tad-data:

2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:

Testi relatati

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0.

3.1 Transparency [24]

_{[24]Elaboration on how to understand the concept of transparency can be found in Article 29 Working Party. «Guidelines on transparency under Regulation 2016/679». WP 260 rev.01, 11 April 2018. ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=51025 — endorsed by the EDPB}

65. The controller must be clear and open with the data subject about how they will collect, use and share personal data. Transparency is about enabling data subjects to understand, and if necessary, make use of their rights in Articles 15 to 22. The principle is embedded in Articles 12, 13, 14 and 34. Measures and safeguards put in place to support the principle of transparency should also support the implementation of these Articles.

66. Key design and default elements for the principle of transparency may include:

•Clarity – Information shall be in clear and plain language, concise and intelligible.

•Semantics – Communication should have a clear meaning to the audience in question.

•Accessibility — Information shall be easily accessible for the data subject.

•Contextual – Information should be provided at the relevant time and in the appropriate form.

•Relevance – Information should be relevant and applicable to the specific data subject.

•Universal design – Information shall be accessible to all data subjects, include use of machine readable languages to facilitate and automate readability and clarity.

•Comprehensible – Data subjects should have a fair understanding of what they can expect with regards to the processing of their personal data, particularly when the data subjects are children or other vulnerable groups.

• Multi-channel – Information should be provided in different channels and media, not only the textual, to increase the probability for the information to effectively reach the data subject.

• Layered – The information should be layered in a manner that resolves the tension between completeness and understanding, while accounting for data subjects’ reasonable expectations.

(a) il-perijodu li matulu d-data personali tkun ser tinħażen, jew jekk dak ma jkunx possibbli, il-kriterji użati biex jiġi ddeterminat dak il-perijodu;

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 14(2)(a) GDPR:

7.4.7 Retention

Control

The organization should not retain PII for longer than is necessary for the purposes for which the PII is processed.

Implementation guidance

The organization should develop and maintain retention schedules for information it retains, taking into account the requirement to retain PII for no longer than is necessary.

(EN) […]

(EN) Sign in
to read the full text

(b) fejn l-ipproċessar ikun ibbażat fuq il-punt (f) tal-Artikolu 6(1), l-interessi leġittimi segwiti mill-kontrollur jew minn parti terza;

(b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

Testi relatati

Artikolu 6 RĠPD (GDPR). Legalità tal-ipproċessar

Article 6 GDPR. Lawfulness of processing

1. L-ipproċessar għandu jkun legali biss jekk u safejn mill-inqas ikun japplika wieħed mill-punti li ġejjin:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

[…]

(f) l-ipproċessar ikun meħtieġ għall-finijiet tal-interessi leġittimi segwiti mill-kontrollur jew minn parti terza, għajr meta dawn l-interessi jingħelbu mill-interessi jew id-drittijiet u l-libertajiet fundamentali tas-suġġett tad-data li jeħtieġu l-protezzjoni tad-data personali, b’mod partikolari meta s-suġġett tad-data jkun minorenni.

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

[…]

(c) l-eżistenza tad-dritt li jitlob mingħand il-kontrollur aċċess jew rettifika jew tħassir ta’ data personali jew restrizzjoni tal-ipproċessar rigward is-suġġett tad-data u li joġġezzjona għall-ipproċessar kif ukoll id-dritt għall-portabbiltà tad-data;

(c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraphs to article 14(2)(c) GDPR:

7.3.5 Providing mechanism to object to PII processing

Control

The organization should provide a mechanism for PII principals to object to the processing of their PII.

Implementation guidance

Some jurisdictions provide PII principals with a right to object to the processing of their PII.

(EN) […]

(EN) Sign in
to read the full text

(d) fejn l-ipproċessar ikun ibbażat fuq il-punt (a) tal-Artikolu 6(1) jew il-punt (a) tal-Artikolu 9(2), l-eżistenza tad-dritt li jiġi irtirat il-kunsens fi kwalunkwe ħin, mingħajr ma tiġi affettwata l-legalità tal-ipproċessar abbażi ta’ kunsens qabel l-irtirar tiegħu;

(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

ISO 27701 Testi relatati

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 14(2)(d) GDPR:

7.3.4 Providing mechanism to modify or withdraw consent

Control

The organization should provide a mechanism for PII principals to modify or withdraw their consent.

Implementation guidance

The organization should inform PII principals of their rights related to withdrawing consent (which may vary by jurisdiction) at any time, and provide the mechanism to do so.

(EN) […]

(EN) Sign in
to read the full text

Testi relatati

Artikolu 6 RĠPD (GDPR). Legalità tal-ipproċessar

Article 6 GDPR. Lawfulness of processing

1. L-ipproċessar għandu jkun legali biss jekk u safejn mill-inqas ikun japplika wieħed mill-punti li ġejjin:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) is-suġġett tad-data jkun ta l-kunsens għall-ipproċessar ta’ data personali tiegħu għal fini speċifiku wieħed jew aktar;

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

[…]

Artikolu 9 RĠPD (GDPR). Ipproċessar ta' kategoriji speċjali ta' data personali

Article 9 GDPR. Processing of special categories of personal data

1. L-ipproċessar ta’ data personali, li jiżvela oriġini razzjali jew etnika, opinjonijiet politiċi, twemmin reliġjuż jew filosofiku, jew sħubija fi trade union, u l-ipproċessar ta’ data ġenetika, data bijometrika sabiex tidentifika b’mod uniku persuna fiżika, data dwar is-saħħa jew data dwar il-ħajja sesswali u l-orjentazzjoni sesswali ta’ persuna fiżika huma projbiti.

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

[…]

2. Il-paragrafu 1 ma għandux japplika jekk japplika wieħed minn dawn li ġejjin:

2. Paragraph 1 shall not apply if one of the following applies:

(a) is-suġġett tad-data jkun ta kunsens espliċitu għall-ipproċessar ta’ dik id-data personali għal fini speċifiku wieħed jew aktar, għajr fejn il-liġi tal-Unjoni jew il-liġi ta’ Stat Membru tipprevedi li l-projbizzjoni msemmija fil-paragrafu 1 ma tistax titneħħa mis-suġġett tad-data;

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

[…]

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0.

3.2 Lawfulness

67. The controller must identify a valid legal basis for the processing of personal data. Measures and safeguards should support the requirement to make sure that the whole processing lifecycle is in line with the relevant legal grounds of processing.

(e) id-dritt li jitressaq ilment quddiem awtorità superviżorja;

(e) the right to lodge a complaint with a supervisory authority;

(f) minn liema sors toriġina d-data personali, u fejn applikabbli jekk oriġinatx minn sorsi aċċessibbli għall-pubbliku;

(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

(g) l-eżistenza ta’ teħid awtomatizzat ta’ deċiżjonijiet inkluż it-tfassil ta’ profili msemmi fl-Artikolu 22(1) u (4) u għall-inqas f’dawk il-każijiet, l-informazzjoni importanti dwar il-loġika involuta, kif ukoll is-sinifikat u l-konsegwenzi previsti ta’ tali pproċessar għas-suġġett tad-data.

(g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

ISO 27701 Testi relatati

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 14(2)(g) GDPR:

7.3.10 Automated decision making

Control

The organization should identify and address obligations, including legal obligations, to the PII principals resulting from decisions made by the organization which are related to the PII principal based solely on automated processing of PII.

(EN) […]

(EN) Sign in
to read the full text

Testi relatati

Artikolu 22 RĠPD (GDPR). Teħid ta' deċiżjonijiet individwali awtomatizzati, inkluż tfassil ta' profili

Article 22 GDPR. Automated individual decision-making, including profiling

1. Is-suġġett tad-data għandu d-dritt li ma jkunx soġġett għal deċiżjoni bbażata unikament fuq ipproċessar awtomatizzat, inkluż it-tfassil ta’ profili, li jipproduċi effetti legali li jikkonċernaw lilu jew li bl-istess mod jaffettwa lilu b’mod sinifikanti.

1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Artikolu 4 RĠPD (GDPR). Definizzjonijiet

Article 4 GDPR. Definitions

Għall-finijiet ta’ dan ir-Regolament:

For the purposes of this Regulation:

[…]

(4) “tfassil tal-profil” tfisser kwalunkwe forma ta’ pproċessar awtomatizzat ta’ data personali li jikkonsisti fl-użu ta’ data personali biex jiġu evalwati ċerti aspetti personali relatati ma’ persuna fiżika, b’mod partikolari biex jiġu analizzati jew imbassra aspetti rigward il-prestazzjoni fuq ix-xogħol, is-sitwazzjoni ekonomika, is-saħħa, il-preferenzi personali, l-interessi, l-affidabbiltà, l-imġiba, il-lokalizzazzjoni jew il-movimenti ta’ dik il-persuna fiżika;

(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

[…]

3. Il-kontrollur għandu jipprovdi l-informazzjoni msemmija fil-paragrafi 1 u 2:

3. The controller shall provide the information referred to in paragraphs 1 and 2:

(a) fi żmien perijodu ta’ żmien raġonevoli wara l-kisba tad-data personali, iżda mhux aktar tard minn xahar, b’kont meħud taċ-ċirkostanzi speċifiċi li fihom tiġi pproċessata d-data personali;

(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;

(b) jekk id-data personali għandha tintuża għal komunikazzjoni mas-suġġett tad-data, sa mhux aktar tard mill-mument tal-ewwel komunikazzjoni lil dak is-suġġett tad-data; jew

(b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or

(c) jekk ikun previst żvelar lil riċevitur ieħor, mhux aktar tard minn meta d-data personali tkun ġiet żvelata l-ewwel darba.

(c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

4. Fejn il-kontrollur ikollu l-intenzjoni li jipproċessa d-data personali ulterjorment għal fini differenti minn dak li għalih tkun inkisbet id-data personali, il-kontrollur għandu jipprovdi lis-suġġett tad-data, qabel dak l-ipproċessar ulterjuri, b’informazzjoni dwar dak il-fini l-ieħor u bi kwalunkwe informazzjoni ulterjuri rilevanti kif imsemmi fil-paragrafu 2.

4. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

5. Il-paragrafi 1 sa 4 ma għandhomx japplikaw meta u sa fejn:

5. Paragraphs 1 to 4 shall not apply where and insofar as:

(a) is-suġġett tad-data diġà għandu l-informazzjoni;

(a) the data subject already has the information;

(b) il-provvista ta’ tali informazzjoni tkun impossibbli li sseħħ jew tkun teħtieġ sforz sproporzjonat; b’mod partikolari għall-ipproċessar għal finijiet ta’ arkivjar fl-interess pubbliku, għal finijiet ta’ riċerka xjentifika jew storika jew għal finijiet ta’ statistika soġġett għall-kundizzjonijiet u s-salvagwardji msemmija fl-Artikolu 89(1) jew sa fejn l-obbligu msemmi fil-paragrafu 1 ta’ dan l-Artikolu jkun ser jagħmilha impossibbli jew ixekkel serjament il-kisba tal-objettivi ta’ dak l-ipproċessar. F’tali każijiet il-kontrollur għandu jieħu l-miżuri xierqa biex jipproteġi d-drittijiet u l-libertajiet u l-interessi leġittimi tas-suġġett tad-data, inkluż li jagħmel l-informazzjoni disponibbli għall-pubbliku;

(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;

Testi relatati

Artikolu 89 RĠPD (GDPR). Salvagwardji u derogi relatati mal-ipproċessar għal finijiet ta' arkivjar fl-interess pubbliku, għal finijiet ta' riċerka xjentifika jew storika jew għal finijiet ta' statistika

Article 89 GDPR. Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

1. L-ipproċessar għal finijiet ta’ arkivjar fl-interess pubbliku, għal finijiet ta’ riċerka xjentifika jew storika jew għal finijiet ta’ statistika, għandu jkun soġġett għal salvagwardji xierqa, f’konformità ma’ dan ir-Regolament, għad-drittijiet u l-libertajiet tas-suġġett tad-data. Dawk is-salvagwardji għandhom jiżguraw li jkunu fis-seħħ miżuri tekniċi u organizzattivi b’mod partikolari sabiex jiġi żgurat ir-rispett tal-prinċipju ta’ minimizzazzjoni tad-data. Dawk il-miżuri jistgħu jinkludu psewdonimizzazzjoni, sakemm dawk il-finijiet jistgħu jiġu sodisfatti b’dak il-mod. Fejn dawk il-finijiet jistgħu jiġu sodisfatti bi pproċessar ulterjuri li ma jippermettix jew ma għadux jippermetti l-identifikazzjoni ta’ suġġetti tad-data dawk il-finijiet għandhom jiġu sodisfatti b’dak il-mod.

1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

[…]

Article 29 Working Party Guidelines on transparency under Regulation 2016/679

“Proves impossible”

The situation where it “proves impossible” under Article 14.5(b) to provide the information is an all or nothing situation because something is either impossible or it is not; there are no degrees of impossibility. Thus if a data controller seeks to rely on this exemption it must demonstrate the factors that actually prevent it from providing the information in question to data subjects. If, after a certain period of time, the factors that caused the “impossibility” no longer exist and it becomes possible to provide the information to data subjects then the data controller should immediately do so. In practice, there will be very few situations in which a data controller can demonstrate that it is actually impossible to provide the information to data subjects. The following example demonstrates this.

Article 29 Working Party Guidelines on transparency under Regulation 2016/679

“Disproportionate effort”

In determining what may constitute either impossibility or disproportionate effort under Article 14.5(b), it is relevant that there are no comparable exemptions under Article 13 (where personal data is collected from a data subject). The only difference between an Article 13 and an Article 14 situation is that in the latter, the personal data is not collected from the data subject. It therefore follows that impossibility or disproportionate effort typically arises by virtue of circumstances which do not apply if the personal data is collected from the data subject. In other words, the impossibility or disproportionate effort must be directly connected to the fact that the personal data was obtained other than from the data subject.

Guidelines on consent under Regulation 2016/679

Scientific research

153. Recital 33 seems to bring some flexibility to the degree of specification and granularity of consent in the context of scientific research. Recital 33 states: “It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose.”

(c) il-kisba jew l-iżvelar hu espressament stabbilit mil-liġi tal-Unjoni jew ta’ Stat Membru li għaliha hu soġġett il-kontrollur u li tipprevedi miżuri adatti għall-protezzjoni tal-interessi leġittimi tas-suġġett tad-data; jew

(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or

Testi relatati

Article 29 Working Party Guidelines on transparency under Regulation 2016/679

The factors referred to above in Recital 62 (number of data subjects, the age of the data and any appropriate safeguards adopted) may be indicative of the types of issues that contribute to a data controller having to use disproportionate effort to notify a data subject of the relevant Article 14 information.

Article 14.5(c) allows for a lifting of the information requirements in Articles 14.1, 14.2 and 14.4 insofar as the obtaining or disclosure of personal data “is expressly laid down by Union or Member State law to which the controller is subject”. This exemption is conditional upon the law in question providing “appropriate measures to protect the data subject’s legitimate interests”. Such a law must directly address the data controller and the obtaining or disclosure in question should be mandatory upon the data controller. Accordingly, the data controller must be able to demonstrate how the law in question applies to them and requires them to either obtain or disclose the personal data in question. While it is for Union or Member State law to frame the law such that it provides “appropriate measures to protect the data subject’s legitimate interests”, the data controller should ensure (and be able to demonstrate) that its obtaining or disclosure of personal data complies with those measures. Furthermore, the data controller should make it clear to data subjects that it obtains or discloses personal data in accordance with the law in question, unless there is a legal prohibition preventing the data controller from doing so. This is in line with Recital 41 of the GDPR, which states that a legal basis or legislative measure should be clear and precise, and its application should be foreseeable to persons subject to it, in accordance with the case law of the Court of Justice of the EU and the European Court of Human Rights. However, Article 14.5(c) will not apply where the data controller is under an obligation to obtain data directly from a data subject, in which case Article 13 will apply. In that case, the only exemption under the GDPR exempting the controller from providing the data subject with information on the processing will be that under Article 13.4 (i.e. where and insofar as the data subject already has the information). However, as referred to below at paragraph 68, at a national level, Member States may also legislate, in accordance with Article 23, for further specific restrictions to the right to transparency under Article 12 and to information under Articles 13 and 14.

(d) fejn id-data personali jkollha tibqa’ kunfidenzjali soġġett għall-obbligu tas-segretezza professjonali regolata mil-liġi tal-Unjoni jew ta’ Stat Membru, inkluż l-obbligu statutorju ta’ segretezza.

(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.

Regolament Ġenerali dwar il-Protezzjoni tad-Data (RĠPD, GDPR)

General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

Kummentarju ISO 27701 Linji ta 'Gwida & Ġurisprudenza Ħalli kumment

Kummentarju

(EN) To facilitate the work of our consultants, we have collected all the requirements and information that have to be mentioned and created a convenient checklist. Next to each paragraph, we have placed links to specific GDPR articles and guidelines. We grouped all the information into 7 sections:

Controller’s identity
Purpose and lawful basis for processing
Personal data
Transfers of data to third countries
Rights
Changes (in privacy notices)
Form (of information provided)

It looks like this:

(EN) […]

(EN) Sign in
to read the full text

(EN) Author

(EN) Siarhei Varankevich CIPP/E, CIPM, CIPT, MBA, FIP

(EN) Co-Founder & CEO of Data Privacy Office LLC. Data Protection Trainer and Principal Consultant

(EN) Ask a question

(EN)

Data Subject Request Letter Sample

Concern: Request of information regarding my personal data

Dear Madam, Dear Sir,

I have a right to be informed, under Article 14 of the General Data Protection Regulation (GDPR), about personal data concerning me that you are processing and that you obtained from any other sources than me…

(EN) […]

(EN) Sign in
to read the full text

(EN) Author

(EN) Louis-Philippe Gratton PhD, LLM

(EN) Privacy Expert

(EN) Ask a question

ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.

Here is the relevant paragraph to article 14 GDPR:

7.3.2 Determining information for PII principals

Control

The organization should determine and document the information to be provided to PII principals regarding the processing of their PII and the timing of such a provision.

Implementation guidance

The organization should determine the legal, regulatory and/or business requirements for when information is to be provided to the PII principal (e.g. prior to processing, within a certain time from when it is requested, etc.) and for the type of information to be provided.

(EN) […]

(EN) Sign in
to read the full text

Linji ta 'Gwida & Ġurisprudenza

(EN)