If someone has not kept the information recieved under Article 13 or 14, then referring to which article he or she can obtain information about the legal basis for processing of personal data? I do not find such possibility under Article 15.
asked Mar 5, 2020 at 14:56
Add a comment
|
1 Answer
GDPR Articles 13–14 assume that the information is provided once. Art 15 has some overlap in the information requirements, but is not identical. The relevant recitals 60–62 offer no further guidance. They state that there's no information obligation where the data subject already posesses the information, but don't account for the case that the information has been lost.
Therefore: the GDPR does not provide an explicit right to receive information per Art 13 & 14 a second time.
However, I'd see a 40% chance that were such an issue presented to the CJEU, the court would find an extended obligation for the data controller to provide this information again on request, as long as the relevant processing is still ongoing and. Such an obligation could be derived from the Art 5(1) transparency principle, and the Art 12(1) obligation to take appropriate measures to provide this information.
In practice, a request for the legal basis is not terribly interesting:
- In many contexts, the appropriate mechanism for fulfilling the information obligations per Arts 13–15 is to publish a privacy policy on a website, so that it is freely available to you.
- Non-shady data controllers are unlikely to reject a request for this information, even if they are not obliged to fulfil it.
- The list of legal bases is typically very uninformative, since most data controllers only list all used legal bases, but do not explain which processing purpose uses which legal basis. That often leads to policies that merely rephrase GDPR Art 6(1).
