Transparency: Article 29 Working Party issues final guidelines

The revisions to the guidance, which was initially released in December 2017, followed a period of open public consultation that ran until 23 January.

On the whole the amendments are minor, with little backtracking on the more demanding requirements adopted in the draft guidance.  

The new points raised by the A29WP are as follows:

More detail on legal basis: In addition to setting out the legal basis for processing, the lawful basis for the processing of special categories of personal data should be specified. Similarly, where data related to criminal convictions is processed the relevant EU or Member State law pursuant to which the processing is carried out should be noted.

Legitimate interest: In addition to specifying the specific interest which the controller relies on, it should be made clear that the individual can obtain further information on the legitimate interest balancing exercise on request, to the extent this information is not already set out in the notice.

Naming recipients: One of the most controversial aspects of the draft guidance was the requirement for controllers to name recipients of the data (including data processors). This requirement is substantially retained: controllers must provide information on recipients which is most meaningful to the individual which the A29WP state will generally be the named recipients. Where a controller chooses to name only categories of recipients the Working Party requires this be as specific as possible indicating the type of recipient, the industry, sector and sub-sector and the recipients’ location.

International transfers: In the draft guidance, the A29WP mandated that the notice explicitly mention all third countries to which the data will be transferred. The finalised guidance adopts more qualified language, although the effect is largely the same, requiring that detail on third country transfers be as meaningful as possible which according to the Working Party  will generally mean that third countries be named.

Surprises should be avoided: The A29WP reminds us that central to transparency is that individuals should not be taken by surprise as to how their data has been used. Controllers should therefore assess whether there are particular risks involved in their processing which should be flagged to the individual in the notice.

Children’s right to transparency: Children don't lose the right to transparency because a parent gives consent on a child’s behalf. Controllers should ensure that where they target children or where they are aware their products or services are used by children, the notice should be presented in a way the child can understand. Sensibly for very young/pre-literate children, the notice can also be addressed to the parents. Where relevant, Controllers also need to consider how to make their notices accessible to children with the  Working Party giving examples such as use of comics/cartoons, pictograms and animations amongst other measures. 

All in one place:  All privacy information addressed to individuals should be available in one place, or one complete document reflecting the A29WP’s earlier position that the individual shouldn’t have to work to find the information.

Changes to privacy notice: It is insufficient and unfair to state in the privacy notice that individuals should regularly check for updates to the notice. As in the draft guidance the Working Party make clear that the onus is on the controller to communicate changes to the notice, and in a way that takes 'all measures necessary' to bring the specific changes to the individual's attention (such communications should also be separate from direct marketing content). The A29WP give non-exhaustive examples of changes to a privacy notice which should always be communicated to an individual, these include: a change in the processing purpose, a change in the controller's identity, and changes as to how an individual can exercise their rights.

Updates for GDPR:  The Working Party recommends that any changes or additions made to notices to align them with GDPR are actively brought to the individual's attention. Interestingly - perhaps in an effort to avoid information overload ahead of 25 May - the Working Party suggest that as a minimum controllers make their updated notices publically available (for example via their website). Where the updates are material or substantive, active communication to individuals is required.  

Privacy reminders: In line with the GDPR principle of accountability, controllers should consider whether, and at what intervals, it is appropriate to provide reminders to individuals of the privacy notice and where it can be found.

Clarity on layered notices: The A29WP clarify that layered notices aren’t exclusive to the online environment: for example where the first communication with the individual is by telephone the first layer of information could be delivered over the phone with the balance provided via email. The Working Party’s guidance on the content of the first layer of information slightly differs depending on when information is deployed in a non-digital or in a digital environment:  in a non-digital environment the A29WP recommends that the first layer of a layered notice should include the purposes of the processing, identity of the controller, and the existence of the individual’s rights together with other information that has most impact on the individual. In a digital environment the A29WP provides that in addition there should be “a description” of the individual’s rights. Furthermore the A29WP underlines that in an online environment the first layer of information should be directly brought to the attention of a data subject at the time of collection of the personal data e.g. displayed as a data subject fills in an online form.

Restrictions on data subject rights: Where national implementing legislation qualify or restrict the data subjects rights, the controller must notify individuals of any qualification to their rights which the controller may rely on.

Exemptions: The A29WP suggest that the narrow exemption to providing notice where it would be impossible or involve disproportionate effort will be particularly relevant for processing for archiving in the public interests, scientific or historical research or statistical purposes. This exemption should not be routinely used by controllers who are not processing data for these purposes. 

The revised guidance on transparency is available here. 

We set out below an updated summary of the information to be provided pursuant to Articles 13 and 14 GDPR, with amendments from the finalised A29WP Guidance in underline for reference. 

For a redline comparison with the earlier draft, click here.