When the personal data are obtained directly from the data subject, it is the data controller’s obligation to provide the data subject with the following information:
- the identity of the data controller and, if required, of the data controller’s representative;
- the purpose of the data processing;
- the third parties or the categories of third parties;
- whether the requested information is compulsory and the consequences of the refusal to provide it;
- the existence of the data subject’s rights, stated by the law, notably the right of access, intervention and objection as well as the terms in which they may be executed;
- the personal data that are being processed;
- information regarding the transfer of personal data, the purpose of transfer and the destination countries;
- any other information required by the DPA, through a written decision.
When the data are not obtained directly from the data subject and there is an intention to disclose the data to a third party, it is the data controller’s obligation to provide the data subject with the following minimum information:
- the identity of the data controller and, if required, of the data controller’s representative;
- the purpose of the data processing;
- the third parties or the categories of third parties;
- whether the requested information is compulsory and the consequences of the refusal to provide it;
- the existence of the data subject’s rights, stated by the law, notably the right of access, intervention and objection as well as the terms in which they may be executed;
- the personal data that are being processed;
- information regarding the transfer of personal data, the purpose of transfer and the destination countries;
- any other information required by the DPA, through a written decision.
Notification to the data subject is not required if the data subject already has the information.
