IAPP Training · Module 6 - BoK III.C
Module 6 · Article 13 vs Article 14 (direct vs indirect collection)
Article 13 governs data collected directly from the data subject - provide the information at the time of collection. Article 14 governs data obtained indirectly, and requires ALL the Article 13 information PLUS the categories of data and the source, within a reasonable period (no later than one month) or at first communication, whichever is earliest. Article 14 has broader exemptions, including impossible or disproportionate effort. The Irish DPC fined WhatsApp €225 million over transparency.
Article 13 applies when data is collected directly from the data subject; Article 14 applies when it is obtained indirectly. Article 14 requires everything in Article 13 plus the categories of personal data and the source.
| Article 13 (direct) | Article 14 (indirect) | |
|---|---|---|
| What to provide | Identity/contact of controller & DPO; purpose & legal basis; recipients; international transfers (adequacy/safeguards + how to get a copy); legitimate interests if relied on; storage period; rights (incl. withdraw consent, complain to an SA); whether provision is a statutory/contractual requirement + consequences; existence of automated decision-making | ALL Article 13 info PLUS the categories of personal data AND the source of the data |
| Timing | At the time of collection | Within a reasonable period (no later than one month); OR at first communication with the data subject; OR at the latest when first disclosed to another recipient - whichever is earliest |
| Exemptions | Essentially only: the data subject already has the information | Data subject already has it; impossible or disproportionate effort, or would seriously impair the purpose; obtaining/disclosure required by law; data must remain secret under a legal obligation |
Key terms - quick answers
What is “Article 13”?
Information to provide when personal data is collected directly from the data subject, given at the time of collection.
What is “Article 14”?
Information to provide when personal data is obtained indirectly (from another source); includes all Article 13 info plus the categories and source of the data.
What is “Disproportionate effort”?
An Article 14 exemption: where informing data subjects would require disproportionate effort, e.g. a large hospital notifying every next-of-kin.