Take-Aways (AI)
- Information obligations may be fulfilled in a “layered” approach; brief information by letter/telephone with a link or QR code to complete online information is sufficient.
- The first layer of information must state the purposes of the processing, the identity of the controller, the rights of the data subject and particularly effective or surprising processing operations.
- For physical contacts, printed flyers with brief information are permitted if complete information is available on site even without Internet access.
- Transmission must be verifiably documented; entry in electronic systems recommended, openness exists with regard to sufficient proof of processes and training.
The Brandenburg State Commissioner for Data Protection has issued a Handout on the duty to inform of the controller according to Art. 13 and 14 DSGVO published. It is worth reading the entire handout, but the following notes in particular are relevant:
- The information should generally be transmitted using the same medium as the communication with the data subject (avoidance of a media break). In the case of offline communication, however, this would mean that information sheets consisting of several pages would have to be sent with each communication. It is therefore permissible to send only the most important information by letter (or on the phone, for example when calling customer service) and, by providing a link or using a QR code refer to a websitewhere the further information can be found. In this respect – in the sense of a “layered” approach – a media discontinuity may be accepted.. The first “information layer” should contain the following items:
- Processing purposes
- Identity of the responsible person
- Description of the rights of the data subject
- Processing operations that would have the greatest impact on the data subject and/or would be surprising.
- Accordingly, it is permissible to use physical contacts with the person concerned (e.g. during a consultation), the most important information (see above) on a (ideally separate) printed flyer which in turn refers to a website with further information, provided that it is possible for the data subject to obtain the complete information on site even without Internet access (for example, by providing a detailed information sheet).
- For telephone Appointments the information does not yet have to be provided; it is sufficient if the information is provided only on the date itself.
- At E‑mail traffic the obligation to provide information can be fulfilled by the e‑mail containing a link to the website on which the complete information is provided.
- To fulfill the Documentation requirement the transmission of the information must be verifiable, e.g. by means of an entry in an electronic recording system. It remains open in the handout whether it is sufficient for proof that corresponding processes are installed and trained.
A good overview of publications by the German data protection supervisory authorities can be found at the Website of the Data Protection Foundation.