In the previous article, various requirements of Article 13 were discussed. It mainly dealt with the information that is to be provided to the data subject when personal data has been obtained from the data subject.
In this article, we shall discuss the requirements of Article 14 which are to be complied with when information has not been obtained from the data subject. The provisions of Article 13 and 14 are very similar barring a few differences. It is to be noted that Article 13 and 14 are said to be complied with when a privacy notice is sent to the data subject.
Let us review the provisions which are different from Article 13:
- The controller shall provide the information to the data subject within a reasonable period but not exceeding one month
- If the personal data shall be used to communicate with the data subject then he/she must be informed at the time of the first communication
- If the personal data is to be shared with a recipient, then the data subject must be informed when the data is disclosed for the first time.
The exceptions to Article 14 are as follows:
- The data subject shall not be provided with information when he/she already has the information
- The provision of information would clash with the interest of the public at large if the processing is used for archiving purposes in the domain of public, history, science and statistics.
- If Union or Member State Law provides for disclosure and also lays down safeguards to protect the data subject
- The personal data cannot be disclosed due to professional secrecy as articulated in the Union or Member State law