The GDPR requires controllers to supply data subjects with detailed information about the processing of their data. Where a controller obtains data directly from data subjects, which of the…

Question

Options

• AThe recipients or categories of recipients.
• BThe categories of personal data concerned.
• CThe rights of access, erasure, restriction, and portability.
• DThe right to lodge a complaint with a supervisory authority.

• A
  7% (3)
• B
  76% (35)
• C
  15% (7)
• D
  2% (1)

Explanation

According to Article 13 of the GDPR, when a controller obtains personal data directly from the data subject, the controller must provide the data subject with certain information about the processing of their data, such as the identity and contact details of the controller, the purposes and legal basis of the processing, the recipients or categories of recipients, the period of storage, the rights of the data subject, the right to lodge a complaint, etc. However, the controller does not have to provide the data subject with the categories of personal data concerned, as this information is already known by the data subject, since they provided the data themselves. This is different from Article 14, which applies when the controller obtains personal data from a source other than the data subject, and requires the controller to inform the data subject of the categories of personal data concerned, as well as the source of the data.

No community discussion yet for this question.