← back to the act's dossier

GDPR — Article 13

The article's text

Article 13 Information to be provided where personal data are collected from the data subject 1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller's representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable s
full text
afeguards and the means by which to obtain a copy of them or where they have been made available. or suitable safeguards and the means by which to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. 4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

Who wrote about this article in the consultations

Filers who named this exact article number in their own text. It is their sentence, not our reading — and not a causal claim.

17
business association
5
company
4
consumer organisation
4
NGO
4
other
WhoCountryWhat they wrote
German Insurance AssociationDEc requirements have the opposite effect. The application of the GDPR showed early on that extensive information obligations under Art. 13, 14 GDPR do not meet the needs of business partners and lead to unnecessary burdens for data subjects and companies. Examp ↗
Bitkom e.V.DErding information obligations have presented challenges, especially concerning the extensive nature of information required under Art. 13 and Art. 14. ↗
WSBI-ESBGBEfficient distinction from the personal reference. - Right of information: According to the EDPB, the data protection information (Art 13 GDPR) should be actively provided to data subjects. This is of course true for the first (initial) processing of personal d ↗
Gesellschaft für Datenschutz und Datensicherheit (GDD) e.V.DEdes Informationszeitpunktes bestehen gewisse Unklarheiten und Unsicher- heiten. Die Form- und Fristenregel des Art. 13 DS-GVO ist insbesondere im Hinblick auf die Erhebung personenbezogener Daten in konkreten Alltagssituationen wenig praktikabel. Im persönlich ↗
Selbstregulierung Informationswirtschaft e.V. (SRIW)DEity”, “ZIP/Post Code”, “Country”, brings minimum added value compared to a reference to “Address Data”. 5.1.2.2. Applicability of Article 13 vs Article 14 In practice, the applicability of Art. 13 and Art. 14 remains ambiguous, especially considering the exemp ↗
UDECAM ( France)FRdes données à caractère personnel sont collectées a. Nous soulignons l’interprétation restrictive des autorités de contrôle de l’article 13 du RGPD. En effet, citer au moment de la sollicitation du consentement l’ensemble des acteurs qui pourraient avoir accè ↗
Confederation of Swedish EnterpriseSEurveillance Act and the GDPR becomes applicable, and the controller thereby has to fulfil e.g. the information requirements under Art. 13-14 GDPR. It would be good if the Commission could consider whether an update to the definition of personal data is called ↗
BundesrechtsanwaltskammerDEf the law, particularly 3 Access to justice and a fair trial must be guaranteed pursuant to Art. 47 sentence 3 CFR, Art. 6 ECHR, Art. 13 ECHR and Art. 19 (4) GG. A necessary prerequisite for this is access to independent and confidential legal advice. Positio ↗
ZVEI e. V. - Verband der Elektro- und DigitalindustrieDEeh- men aber stark in ihrer Handlungsfähigkeit einschränkt. Dies führt zu unbilligen Ergebnissen. So müssen Unternehmen gemäß der Artikel 13 und 30 DSGVO grundsätzlich jede Liste, die personenbezogene Daten enthält dokumentieren bzw. konkret darüber informiere ↗
Fonds Soziales WienATbei Unmöglichkeit oder unverhältnismäßigem Aufwand auch im Anwendungsbereich des Art 13 DSGVO gilt. 3. Anmerkungen zu dem Recht auf Erhalt einer Kopie gem. Art 15 Abs 3 DSGVO In der Rechtssache C 487/21 hat der EuGH nun Fragen zu Inhalt und Umfang des Betroffe ↗
Die Deutsche KreditwirtschaftDEthe experience gained in the meantime, the following points in particular need to be improved: - The information requirements in Art. 13 and 14 GDPR are too detailed and excessive. They should be kept to a reasonable level in order to avoid flooding data subj ↗
United InternetDEection regulations and the AI Act is vital. Ensuring that responsible parties can comply with their information obligations under Art. 13 and 14 of the GDPR and enforcing data subject rights under Art. 12 ff of the GDPR, especially in the processing of sensiti ↗
ZKI e.V.DEn der Datenerhebung Kenntnis erhält. Zumindest sollte geprüft werden, ob die Ausnahmetatbestände des Art. 14 Abs. 5 DSGVO auch in Art. 13 Abs. 4 DSGVO verankert werden können.  In Art. 33 DSGVO sollte klargestellt werden, dass nicht jedes Risiko für die Recht ↗
Insurance EuropeBEo be provided. Based on members’ experience, the majority of data subjects just want access to their data and are uninterested in Art. 13/14 detail specific to them. Therefore, unless the data subject explicitly requests such tailored information after being a ↗
Federation of Austrian IndustriesATtype and level of detail of the information to be provided (Articles 12 to 14) To provide information actively in compliance with Art 13 and 14 GDPR using the EDPB- Guidelines approach of a layered privacy notice seemed to have become a commonly accepted stand ↗
AUSTRIAN FEDERAL ECONOMIC CHAMBERATn which additional data must be collected in order to be able to offer the information). In any case, the exceptions according to Art 13 Paragraph 4 GDPR must be aligned with those in Art 14 Paragraph 5 GDPR. ↗
DATEV eGDEhe evaluation and review of the General Data Protection Regulation (GDPR).1 Information Fatigue The information obligations under Art. 13 and 14 GDPR have led to an overload of information, which is neither requested nor acknowledged by the data subject. ↗
Insurance IrelandIEuding the type and level of detail of the information to be provided (Articles 12 to 14) In relation to the Right to be Informed (Article 13 and 14), II members’ view as Controllers, is that there is conflict between the amount of information to be disclosed ( ↗
Jorge CabetESmenores -pero con igual riesgo sancionador- hubiera sido una fórmula ideal para su aplicación. Por ejemplo, un deber de informar (art. 13) con menos requisitos y limitado a tratamientos tasados (por ejemplo, cuyas finalidades puedan implicar una afectación a d ↗
Hans-Hermann SchildDEBescheid zukommen lässt (Art. 13 VO-E), was sich letztend- lich schon aus Art. 60 Abs. 8 bis 10 DSGVO ergibt. Damit ist noch einmal dokumentiert, dass in Verfahren des One-Stop-Shop, die Aufsichtsbehörde im Verhältnis zu dem Be- schwerdeführer zuständig ist, b ↗
noybATxpanded for no more than one weeks if the supervisory authorities are otherwise unable to provide for a translation of documents. Article 13 - Handling of complaints 1. Within two weeks from the provision of the statement under Article 12(4), the supervisory ↗
Access Now EuropeFR, where nature of the case so permits, if necessary to hear collectively all parties. Iceland Administrative Procedure Act (1993) Article 13. Right to be heard for parties, with exceptions (if clearly unnecessary or party's position on the matter already appea ↗
—ssues which are explained in detail and with practical examples in our attached document: - The information to be provided due to Art. 13 and Art. 14 GDPR is too extensive in everyday life situations and where it relates to personal data which are manifestly m ↗
Gesamtverband der Deutschen Versicherungswirtschaft e.V.DErtificates which are approved by the da- ta protection authorities. 4. Reducing bureaucracy a) Obligation to provide information (Art. 13, 14 GDPR) Experience with the GDPR has soon shown that the extensive obligations to provide information pursuant to Articl ↗
—order by collecting additional data to elucidate a yet still-uncertain pathobiology. Where possible, the information according to Art. 13 would then be provided to these patients as soon as they are sufficiently recovered. In addition, relevant relatives or pr ↗
ELIXIR LuxembourgLUlude a change of recipients or categories of recipients. The same change would then apply to Article 14(2). - Consistency between Art. 13(1)/(2) and Art. 14(1)/(2) The obligation to inform the data subject about the legitimate interest pursued by the controlle ↗
Deutsche Vereinigung für Datenschutz e.V.DEfür den „Bericht über die DSGVO“ der EU-Kommission Seite 2 personenbezogener Daten die Datenschutzhinweise gemäß Art. 13 DSGVO vorzulesen oder von ei- nem Band ansagen zu lassen. In der täglichen Praxis ist dies aber meist wenig zielführend. Die teil- weise ge ↗
Multi-Regional Clinical Trials Center of Harvard University and Brigham and Women’s HospitalUS4. Note that when data are collected directly from the data subject, the notice must be provided at time of collection, see GDPR, art. 13, whereas when the data are collected from another source, the notice must be provided within one month of collection. 70 ↗
European Publishers CouncilGBinform the data subject of any recipients or categories of recipients of the personal data (GDPR, Article 13(1)(c)). Additionally, if the data subject exercises his or her right of access, the controller must be able to inform him or her of the recipients or c ↗
FEVADFRde destinataires plutôt que des catégories de destinataires, option pourtant bien prévue par le RGPD (article 13). Le projet de recommandation français sur les cookies prévoit en effet que l’utilisateur doit pouvoir prendre connaissance de l’identité de l’ense ↗

Source: public consultation submissions and position papers. n = 42 mentions; counted as a literal reference to the article number.

Ask about this article →