The controller must, during the stage of collection of personal data, inform the data subject in an appropriate and express manner of the following data:
- his/her identity and the identity of his/her representative or any other 3rd party, if any,
- the purpose and legal basis of data processing,
- the recipients or the categories of recipients of such data,
- the existence of a right: to access, rectification, erasure, restriction of processing, objection to processing, data portability, withdraw of consent, filing a complaint with the DPA;
- the storage period;
- details of transfers to third countries if applicable;
- the existence of automated decision-making, including profiling, if applicable.
Please see: Article 29 Working Party has issued Guidelines on Transparency (WP260).
In Greece, the position on the language of privacy notices is yet to be determined.