Article 13 vs Article 14 - what must be provided
The primary information duties sit in Article 13 (data collected directly from the data subject) and Article 14 (data obtained from another source). Both require broadly the same fair processing information, split across paragraph (1) and paragraph (2). Article 14 adds two extra items - the categories of personal data and the source of the data - but drops the statutory/contractual-requirement item that only makes sense when the subject themselves supplies the data. The WP29/EDPB treat paragraph (1) and paragraph (2) information as equal in status, so both sets must be provided unless an exemption applies.
Article 13(1) and (2) list the information due when data are collected directly from the data subject. Article 14(1) and (2) require the same information when data are obtained from another source, plus two extra items, but omits one item that only applies to direct collection.
| Article 13 | Article 14 | |
|---|---|---|
| When it applies | Personal data collected directly from the data subject | Personal data NOT obtained from the data subject (third party, public source) |
| Core info (para 1) | Controller/representative identity & contacts; DPO contacts; purposes & legal basis; legitimate interests pursued (if 6(1)(f)); recipients/categories; intent to transfer to a third country + safeguards | Same as Article 13(1) |
| Further info (para 2) | Retention period/criteria; data subject rights; right to withdraw consent (if consent-based); right to complain to a supervisory authority; whether provision is statutory/contractual & consequences; existence of automated decision-making/profiling + logic | Same as Article 13(2), EXCEPT the statutory/contractual-requirement item is dropped |
| Extra items unique to it | (none) | Categories of personal data concerned; the source the data came from (and whether from publicly accessible sources) |
| Item it does NOT include | (includes the statutory/contractual-requirement item) | No statutory/contractual-requirement-to-provide item (subject did not supply the data) |
| Timing | At the time the personal data are obtained | Within a reasonable period, at the latest within one month; or at first communication; or at first disclosure (whichever is earliest) |
| Disproportionate-effort / impossibility exemption | Not available under Article 13 | Available under Article 14(5)(b) (e.g. research/archiving), with safeguards |
The categories of personal data and the source of the data are unique to Article 14. The statutory/contractual-requirement item appears in Article 13 but not in Article 14, because under Article 14 the subject did not supply the data themselves.
It is unclear why the information is split across paragraphs (1) and (2). The WP29 (endorsed by the EDPB) treats both paragraphs as equal in status, so in practice both sets must be provided in all cases unless an exemption applies - removing much of a controller's discretion to tailor what is given.