← back to the act's dossier

GDPR — Article 12

The article's text

Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject 1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means. the information may be provided orally, provided that the identity of the data subject is proven by other means. 2. The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a posi
full text
tion to identify the data subject. under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject. 3. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. 4. If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. 5. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. 6. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. 7. The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically they shall be machine-readable. overview of the intended processing. Where the icons are presented electronically they shall be machine-readable. 8. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons. Section 2 Information and access to personal data

Who wrote about this article in the consultations

Filers who named this exact article number in their own text. It is their sentence, not our reading — and not a causal claim.

18
business association
10
NGO
7
company
4
EU citizen
2
other
WhoCountryWhat they wrote
EDRi European Digital RightsES| Tel. +32 2 274 25 70 | www.edri.org While data controllers at least pay some lip service to the information obligations of article 12 and 13, article 14 is extremely poorly complied with, both in the private and public sector. This is deeply concerning ↗
Asociación Española de Economía Digital (Adigital)ESnting abuse, we would suggest tightening the understanding of the normative element of the offence “manifestly unfounded”, within Article 12 by having a non-exhaustive list of case groups. This would not be to the detriment of the data subject since the assump ↗
Selbstregulierung Informationswirtschaft e.V. (SRIW)DEprinciple, e.g., in Art. 11.1 GDPR. Data subject rights may also be performed abusively, which is acknowledged by GDPR, e.g., in Art. 12.6 or Art. 12.5 GDPR. Art. 12.6 clarifies that doubts in respect of a data subject’s identity shall be good reason for reje ↗
German Insurance AssociationDEessure or Seite 4 von 18 harassment, should be included as standard examples of a non-existent right to information in Art. 15 or Art. 12 para. 5 GDPR. ↗
Confederation of Swedish EnterpriseSEstrictly for reasons of data protection, and not be considered an absolute right. One way to address this issue could be to amend Art. 12 (5) GDPR, regulating manifestly unfounded or excessive requests. The EDPB Guideline on Right of Access needs to be updated ↗
Spolek pro ohranu osobních údajůCZrmation requested. A more straightforward interpretation of the controllers options to handle data subjects requests according to Art. 12 (5) is needed. "Excessive and unfounded" should be interpreted also in line with the availability of data processed throug ↗
ANITEC-ASSINFORMITswer – Detailed 1. There is a lack of clarity on what comprises a request that is manifestly unfounded or excessive: Art. 12(5) GDPR allows controllers to reject requests that are manifestly unfounded or excessive, or to charge a reasonable fee fo ↗
—FRShield était invalidé depuis des années et le DPF inexistant… … … Que dire ? Quand, dans le cadre de mes demandes d’information (article 12), je vois des DPO défendre mordicus que des liens et des images de traçage dans les emails constituent des stats agrégé ↗
BundessteuerberaterkammerDEroffenen Personen usw.). Informationspflichten, einschließlich Art und Detaillierungsgrad der bereitzustellenden Infor- mationen (Artikel 12 bis 14), Umsetzung der Anforderung des EuGH zur Benennung der kon- kreten Empfänger. Bitte geben Sie nach Möglichkeit e ↗
The Information Technology Industry Council (ITI)USuch resolution. Greater clarity is needed on what constitutes a data subject request that is “manifestly unfounded or excessive” (Article 12(5) GDPR). This would help reduce the current administrative burden of proving the inadmissibility of such requests, and ↗
Observatorio Internacional de Derechos Humanos del Ilustre y Nacional Colegio de Abogados de MéxicoMEpaíses: • Argentina (art. 12 ley n. 25.326 de protección de datos personales, art. 12 del decreto reglamentario n. 1558/2001 y Disposición n 60). • Brasil (arts. 33 a 35 de la Ley general de Protección n de Datos). • Cabo Verde (art. 20, Ley no 41/VIII/2013, ↗
BundesrechtsanwaltskammerDE3), Art. 103 (1) GG, Art. 2 (1) in conjunction with Art. 1 (1) GG in conjunction with Art. 1 (1) GG, Art. 8 (1) ECHR, Art. 7 CFR, Art. 12 (1) GG. It primarily serves to protect the client and his access to justice. Lawyer-client confidentiality protects victim ↗
Bitkom e.V.DEta subject and the scope of the right. The need for clarification on the concept of "manifestly unfounded or excessive" requests (Art. 12(5)) is evident, along with the necessity to strike a balance between the right to access and the protection of personal da ↗
5Rights FoundationGBted by the child. Age Appropriate Design Code (UK) 6. Transparency and enabling of rights Transparency obligations are set out in Article 12 of the GDPR, which requires information to be provided to the data subject “in a concise, transparent, intelligible and ↗
Bundesvereinigung der Deutschen ArbeitgeberverbändeDEmeldung zum Bericht über die Datenschutz-Grundverordnung Schwerpunkt der Stellungnahme: Beschäftigtendatenschutz 08. Februar 2024 Art. 12 Angesichts der zunehmenden Anzahl an Auskunftsersuchen ist die Frist für die Auskunftserteilung zu kurz. Sie sollte mindes ↗
Verband der öffentlichen Wirtschaft und Gemeinwirtschaft Österreichs (VÖWG)ATer nicht mehr identifiziert werden kann, sollte angedacht werden, gewisse Erleichterungen iSd DSGVO zu erwirken. ErwG 39 & 58 iVm Art. 12 & 15: Besonders im technischen bzw. medizinischen Bereich stehen Verantwortliche bei z.B. Auskunftsbegehren gem. Art. 15 v ↗
BDI e.V. (Federation of German Industries)DEcised strictly for reasons of protection of personal data, and not be considered an absolute right. Therefore, a clarification of Article 12 (5) GDPR (manifestly unfounded or excessive requests) is necessary: - attempts at gathering information in a pre-litiga ↗
United InternetDEle parties can comply with their information obligations under Art. 13 and 14 of the GDPR and enforcing data subject rights under Art. 12 ff of the GDPR, especially in the processing of sensitive data under Art. 9 GDPR, remain key considerations. On the other ↗
Insurance EuropeBEe case of a data-loss event and therefore should not be included in the scope of the right of access. • The guidelines state that Art. 12 (5) on manifestly unfounded requests should be interpreted narrowly and that an access request should not be regarded as e ↗
World Employment ConfederationBEf access should be exercised for legitimate personal data protection purposes and not as an absolute right. Clarification of GDPR Article 12(5) is needed to avoid excessive gathering of information, e.g. ↗
ZKI e.V.DEals auch die Verantwortlichen spürbar entlasten.  Die Einführung von standardisierten Bildsymbolen für betroffene Personen gemäß Art. 12 Abs. 7, 8 DSGVO sollte weiter vorangetrieben und abgeschlossen werden. Insbesondere sollte die Möglichkeit der Nutzung von ↗
Berufsverband der Datenschutzbeauftragten Deutschlands (BvD) e.V.DEdern gemäß Art. 5 Abs. 2 i.V.m. Abs. 1 lit. a DSGVO muss auch dokumentiert werden, dass diese Pflichten erfüllt werden, und gemäß Art. 12 DSGVO müssen – unabhängig von der Unternehmensgröße – nachweislich Maßnahmen implementiert werden, um diese Transparenzpfl ↗
Ministerium für Wirtschaft, Industrie, Klimaschutz und Energie des Landes Nordrhein-WestfalenDEaftlichen Betrieb erheblich zu beeinträchtigen. Die Kommission wird gebeten zu prüfen, ob über die Formulierung „insbesondere“ in Art. 12 Abs. 5 S. 2 DS-GVO auch das kollusive Zusammenwirken mehrerer Antragstellenden als missbräuchlich im Sinne der Norm einges ↗
DATEV eGDEinformation fatigue. This can be achieved with the the implementation of standardised symbols as proposed in Art. 12 (8), which the EU-Commission has yet to put forward. Making the GDPR more SME-friendly Furthermore, SMEs in particular have difficulties to ful ↗
Media Scope Group OÜEE, it is proposed that information relevant to data protection be clustered and standardised symbols be implemented as proposed in Article 12 (8) of the GDPR. Making the GDPR more SME-friendly Small and medium-sized enterprises (SMEs) in particular have difficu ↗
Nicolas VINOTFRe 17) — Présence de traceurs ou de cookies non techniques (article 6) — Retard ou absence de réponse suite à une demande d’accès (article 12 & 15) — Réponse incomplète sinon vide suite à une demande d’accès (article 12 & 15) Les articles concernés sont parmi l ↗
Anonos Inc.USsession of “Additional Information” necessary for re-identification satisfy this requirement. b. Pseudonymization helps to enable Article 12(2) relaxation of obligations under Articles 15 (Right of Access by Data Subject), 16 (Right to Rectification), 17 (Righ ↗
Hans-Hermann SchildDEin den Fällen der vollständigen oder teilweisen Ablehnung die Anhörung des Beschwerdeführers durchführen soll (Art. 12 VO-E) und bei einer vollständigen oder teilweisen Abweisung der Beschwerde wiederum die Aufsichtsbe- hörde, bei der die Beschwerde eingelegt ↗
noybATadmissible after (1) the data subject has provided a written request to the controller and (2) the 1-month period foreseen under Article 12(3) GDPR for the controller to answer has passed. When the issue is precisely that the data subject cannot identify the ↗
Border Violence Monitoring NetworkDEnd processing of the data collection is to be provided in a “concise, transparent, intelligible and easily accessible form” under Article 12. It is impossible to fulfil this obligation if the information is not conveyed in a language which the relevant party u ↗

Source: public consultation submissions and position papers. n = 45 mentions; counted as a literal reference to the article number.

Ask about this article →