The data controller or their representative must provide the data subject from whom personal data are obtained with the following information, except where they already have it:
- the identity of the data controller and of his representative, if any;
- where applicable, the contact details of the data protection officer;
- the purpose of the processing for which the data are intended;
- the legitimate interests pursued by the controller or by third parties;
- the possible consequences for him of the absence of a reply;
- the recipients or categories of recipients of the data;
- the existence of the right to request from the controller the access to personal data, the rectification or deletion of such data, or a limitation of the treatment relating to the data subject, or the right to object to processing and right to portability of data;
- The right to withdraw consent at any time, without prejudice to the lawfulness of treatment, prior to the withdrawal of the treatment;
- the right to lodge a complaint with a supervisory authority;
- the intended transfer of personal data to a State that is not a Member State of the European Union and specific details regarding the conditions of transfer.
- the retention period of the categories of data processed or, if that is not possible, the criteria used to determine this duration.
French Law “Informatique et Libertés » also invokes data subject’s right to give instruction, to the processor or his legal representative, concerning the use and disclosure of his data after his death.
According to the EDPB guidelines on Transparency, it is not mandatory for the collection medium to contain all these information.
Governing law: Title I – CHAPTER IV – FORMALITIES PRIOR TO THE IMPLEMENTATION OF THE TREATMENTS, Article 32, Modified by the law n ° 2018-493 of June 20th, 2018