How to ‘provide’ information (Art. 12 GDPR)? European Court of Justice requires active behavior

Abstract

The controller shall inform the data subject (e.g. consumer) about the extent of the data processing (Art. 13 GDPR). But, what measures are required to provide this information to the data subject according to Art. 12 GDPR? Is it necessary to send a written statement to the data subject or is it sufficient to publish the information on the website? The European Court of Justice (ECJ) held a judgement regarding this aspect in 2017. The ECJ stated that the organisation, which is responsible to provide the information, “...must actively communicate that information.“1 This decision has a significant impact on cost and efforts of the GDPR-implementation projects. In general, the legal interpretation starts with the interpretation of the wordings of the respective legal source – in our case the GDPR. But the term to “provide“ information is not defined in Art. 4 GDPR. An additional approach to get more clarity of the wording is referring to the different language versions of the GDPR. The French version of Art. 12 GDPR uses the verb “fournier“ and the German version uses the wording “übermitteln“. In contrast to the English and French version the German term “übermitteln“ is defined as “transmission“ according to Art. 4 (2) GDPR, which is a sub-activity to data processing. In that context transmission means a transfer of personal data to a third party. All versions – the English “provide“, the French “fournier“ and the German “übermitteln“ – have in common that the wording requires an active behavior of the controller to transfer the information into the sphere of the data subject. Recently, Art. 29 Working Party has published its Working Paper (WP 260) regarding transparency. The latest Working Papers are a de facto binding interpretation of the GDPR because on 25th of May the Working Party will be transformed into the European Data Protection Board. Since