Take-Aways (AI)
- The information obligations under Art. 13 and 14 GDPR allow for a layered approach; in the case of telephone contact, basic information with reference to further content is sufficient.
- Simply referring to a website is not enough; basic information must be actively communicated, and the responsible party is the company, not individual employees.
The State Commissioner for Data Protection of the State of Lower Saxony has FAQ on the information requirements published in accordance with Art. 13 and 14 DSGVO.
Notable points include the following:
- For the indication of the controller, it seems to be necessary to indicate not (only) the name of the company, but also the name and address of the managing director. This is not covered by the wording of Art. 13 and 14 GDPR. The controller is clearly the company, not the individual employee.
- When specifying the processing purposes, it is sufficient, for example, to refer to “advertising purposes”; the information apparently does not need to be more specific.
- With regard to the storage period, reference can be made to the “retention period for tax purposes”, for example.
- In the case of the right of appeal, reference should be made to the name of the specific competent authority.
- The person responsible can take a layered approach to providing information. In the case of personal contact, it is sufficient if the person responsible refers the data subject to a notice, for example. At telephone contacts it is sufficient to point to the Responsible persons, the Editing purposes and exemplary to the Access right for everything else can be referred to e.g. a Website be referred to. With a pure Appointment on the phone must initially not be informed at all. When communicating by Letter an information sheet can be enclosed. For communication by E‑mail a “brief presentation of basic information” is sufficient; otherwise, reference can be made to a website.
- The mere reference to a website, on the other hand, is not sufficient.. The basic information must be communicated (apparently in the sense of a declaration requiring receipt).
- Also the exchange of Business cards is explained.
- No information obligation exists vis-à-vis persons whose data had been collected prior to the entry into force of the GDPR. The same will apply under the new DPA.
- It is enough to Information in German even in the case of an identifiably foreign-language addressee group; in this case, information in a correspondingly foreign language is only recommended. Exception: a web store that is aimed at persons in other European countries.
- Photographs taken at parties, etc., must also include at least basic information.5