According to Article 14 of the GDPR, how long does a controller have to provide a data subject with necessary privacy information, if that subject's personal data has been obtained from other sources?

Question

Options

• AAs soon as possible after obtaining the personal data.
• BAs soon as possible after the first communication with the data subject.
• CWithin a reasonable period after obtaining the personal data, but no later than one month.
• DWithin a reasonable period after obtaining the personal data, but no later than eight weeks.

• A
  6% (2)
• B
  3% (1)
• C
  91% (32)

Explanation

According to Article 14 of the GDPR, if the controller obtains personal data from other sources, such as third parties or publicly accessible sources, the controller must provide the data subject with the necessary privacy information, such as the identity and contact details of the controller, the purposes and legal basis of the processing, the categories of personal data concerned, the recipients or categories of recipients of the personal data, and the rights of the data subject. The controller must provide this information within a reasonable period after obtaining the personal data, but no later than one month, having regard to the specific circumstances in which the personal data are processed. However, there are some exceptions to this rule, such as if the data subject already has the information, if the provision of the information proves impossible or would involve a disproportionate effort, if the obtaining or disclosure of the data is expressly laid down by EU or member state law, or if the personal data must remain confidential subject to an obligation of professional secrecy.

No community discussion yet for this question.