HumenhukCIPP/E Study Guide
Ch 8.1.4 - Extra info duties

Situations requiring additional information

Reviewed by Victor Humenhuk. Published . Reviewed .

Beyond Articles 13/14, the GDPR triggers extra information duties in specific situations, whether or not the data came from the subject: data subject rights (especially the right to object, which must be presented clearly and separately), certain international transfers, processing for a new purpose, joint-controller arrangements (the essence of which must be made available), and personal data breaches. A recurring distinction is between actively providing information and merely making it available.

  • Data subject rights: the right to object (legitimate interests / public-interest tasks, or direct marketing) must be explicitly brought to attention and presented clearly and separately from other information.
  • International transfers: extra detail is owed where transfers rely on compelling legitimate interests (Art 49(1) second subpara), on consent (Art 49(1)(a) - including the risks of no adequacy/safeguards), or on binding corporate rules.
  • New purpose: inform the subject of the new purpose plus relevant further information before further processing begins.
  • Joint controllers: make the essence of the arrangement available; it must be obvious which controller fields enquiries.
  • Personal data breaches: in some cases data subjects must be notified (covered in Chapter 10).
Provide vs make available

The duty to make available the essence of a joint-controller arrangement is weaker than the active duty to provide information under Articles 13/14. The right to object, by contrast, demands more - it must be explicitly brought to the attention of the data subject.

Key terms - quick answers

What is “Right to object”?
The data subject's right (Article 21) to object to processing based on legitimate interests/public-interest tasks, or to direct marketing; it must be explicitly brought to attention, clearly and separately.
What is “New purpose (further processing)”?
Where a controller intends to use data for a purpose other than originally collected; it must inform the subject of the new purpose plus relevant further information before that processing starts.
What is “Joint controllers”?
Two or more controllers jointly determining purposes and means; they must transparently allocate responsibilities and make the 'essence' of the arrangement available to data subjects.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.