Documents
Article 29 Working Party, Opinion 2/2010 on behavioural advertising (2010):
The obligation to provide the necessary information and obtain data subjects’ consent ultimately lies with the entity that sends and reads the cookie. In most cases, this is the ad network provider. When publishers are joint-controllers, for example in those cases where they transfer directly identifiable information to ad network providers, they are also bound by the obligation to provide information to data subjects about the data processing.
(58) Il-prinċipju tat-trasparenza jeħtieġ li kwalunkwe informazzjoni indirizzata lill-pubbliku jew lis-suġġett tad-data tkun konċiża, aċċessibbli faċilment u faċli li tinftiehem, u li jintuża lingwaġġ ċar u sempliċi u, barra minn hekk, fejn meħtieġ, tintuża l-viżwalizzazzjoni. Tali informazzjoni tista' tingħata f'forma elettronika, pereżempju, meta tiġi indirizzata lill-pubbliku, permezz ta' sit elettroniku. Dan huwa partikolarment rilevanti f'sitwazzjonijiet fejn il-proliferazzjoni ta' atturi u l-kumplessità teknoloġika tal-prattika jagħmluha diffiċli għas-suġġett tad-data li jkun jaf u jifhem jekk hijiex, minn min u għal liema għan qed tinġabar data personali dwaru, bħal fil-każ ta' reklamar online. Minħabba li t-tfal jistħoqqilhom protezzjoni speċifika, kwalunkwe informazzjoni u komunikazzjoni, fejn l-ipproċessar huwa indirizzat lil xi minorenni, għandha tkun f'lingwaġġ ċar u sempliċi li l-minorenni jista' jifhem faċilment.
ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.
Here is the relevant paragraph to article 12(2) GDPR:
7.3.1 Determining and fulfilling obligations to PII principals
Control
The organization should determine and document their legal, regulatory and business obligations to PII principals related to the processing of their PII and provide the means to meet these obligations.
[…]
Sign in
to read the full text