CIPP/E Study Guide
Ch 8.1.4 - Extra info duties

Situations requiring additional information

Beyond Articles 13/14, the GDPR triggers extra information duties in specific situations, whether or not the data came from the subject: data subject rights (especially the right to object, which must be presented clearly and separately), certain international transfers, processing for a new purpose, joint-controller arrangements (the essence of which must be made available), and personal data breaches. A recurring distinction is between actively providing information and merely making it available.

  • Data subject rights: the right to object (legitimate interests / public-interest tasks, or direct marketing) must be explicitly brought to attention and presented clearly and separately from other information.
  • International transfers: extra detail is owed where transfers rely on compelling legitimate interests (Art 49(1) second subpara), on consent (Art 49(1)(a) - including the risks of no adequacy/safeguards), or on binding corporate rules.
  • New purpose: inform the subject of the new purpose plus relevant further information before further processing begins.
  • Joint controllers: make the essence of the arrangement available; it must be obvious which controller fields enquiries.
  • Personal data breaches: in some cases data subjects must be notified (covered in Chapter 10).
Provide vs make available

The duty to make available the essence of a joint-controller arrangement is weaker than the active duty to provide information under Articles 13/14. The right to object, by contrast, demands more - it must be explicitly brought to the attention of the data subject.

Key terms - quick answers

What is “Right to object”?
The data subject's right (Article 21) to object to processing based on legitimate interests/public-interest tasks, or to direct marketing; it must be explicitly brought to attention, clearly and separately.
What is “New purpose (further processing)”?
Where a controller intends to use data for a purpose other than originally collected; it must inform the subject of the new purpose plus relevant further information before that processing starts.
What is “Joint controllers”?
Two or more controllers jointly determining purposes and means; they must transparently allocate responsibilities and make the 'essence' of the arrangement available to data subjects.