Collectors falling under the purview of the GDPR or Convention 108 must notify data subjects of the collection of their personal data unless they fall under the exemption provided for by Article 14 of the GDPR and Article 8(3) of Convention 108, described below.1 Collectors not covered by either instrument should still consider whether they fall under the terms of the exemption, and if not, consider notifying the data subjects. Notification can entail, for example, the Collector contacting the individual(s) whose personal data has been collected via email or post.
To qualify for the exemption, Collectors must demonstrate that:
- notifying the data subject about the collection of their personal data would be impossible; or
- notifying the data subject about the collection of their personal data would involve disproportionate effort; or
- notifying the data subject about the collection of their personal data would make achieving the collection efforts impossible or seriously impair them.2 (This exemption is particular to the GDPR and is not included in Convention 108)
The exemption in Article 14 of the GDPR comes with a number of procedural safeguards that Collectors must comply with. As such, Collectors to whom the GDPR applies are advised to seek specialist advice on qualifying for the Article 14 exemption and the procedures to follow for compliance with the exemption conditions.
Legal Framework
Footnotes
-
GDPR, Article 14; Convention 108, Article 8(3). ↩
-
GDPR, Article 14(5)(b); Convention 108, Article 8(3). ↩