FORMAL ANSWER

Where personal data are collected from the data subject, the controller must inform them of the controller’s identity and contact details, and of the contact details of the data protection officer (if one is designated). The controller must also provide information on: the purposes and legal basis of processing (including legitimate interests, where applicable), recipients to whom personal data will be disclosed, transfers outside the EU, the storage period, the rights of the data subject, whether providing personal data is a requirement or voluntary, and whether personal data will be used for automated decision-making and, if so, on what terms.

Where personal data are obtained other than from the data subject, the controller must additionally inform the data subject of the categories of personal data obtained and the source from which the data originated.

PRACTICAL ANSWER

Fulfilling the information obligation means providing every person whose data are processed with information so that they know what happens to their personal data, whom to contact if their rights are infringed, and what they consent to when agreeing to processing. Controllers most often meet this obligation through information clauses, privacy policies or terms of electronic service provision.

MORE:

• You can find more information in the article: The information obligation in light of the first Polish DPA fine
• Sample information clauses are available in the article: GDPR clauses