SkarpChapter 9 of 16
The Operative Principles, Transparency Duties, and Right of Access
Articles 5–15 convert the recital framework into enforceable requirements governing lawful processing, consent, sensitive data, communications, and access. The result is a connected system in which controllers must justify processing and give individuals usable visibility into it.
1. Articles 5-15: A Connected Compliance System
A sequence of duties
Articles 5-15 form a workflow: principles, lawful basis, consent and sensitive-data limits, transparent communication, information duties, and access.
Controller and data subject
The controller must justify and explain processing. The data subject receives information and can ask whether processing occurs, obtain access, and receive a copy.
Read provisions by trigger
Each Article has conditions: consent-based processing, children, direct collection, indirect collection, requests, transfers, and identification limits all activate different rules.
2. Article 5: The Six Processing Principles and Accountability
Six filters
Article 5(1) requires lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality.
Purpose and quantity
Purposes must be specified, explicit, and legitimate. Data must be adequate, relevant, and limited to what is necessary in relation to those purposes.
Time, quality, security
Data must be accurate where necessary, identifiable no longer than necessary, and protected against unauthorised processing and accidental loss, destruction, or damage.
Accountability
Article 5(2) requires responsibility plus demonstrable compliance. It does not merely ask a controller to intend to follow Article 5(1).
3. Applying Article 5: A University Event App
Start with stated purposes
For event registration, plausible purposes include reserving a place, sending logistics, and arranging catering. Purpose limitation tests later uses against those purposes.
Ask of every field
Is this datum adequate, relevant, and limited to what is necessary? The answer may differ for a university email, dietary requirement, passport number, or political view.
Design for the data lifecycle
Article 5 also requires accuracy, no longer identifiable storage than necessary, and appropriate technical or organisational security measures.
Evidence matters
The controller must be able to demonstrate compliance. It should be able to explain why each data item, use, retention period, and safeguard relates to its purposes.
4. Article 6: Lawfulness, Legal Bases, and Further Processing
The lawfulness threshold
Article 6(1) requires at least one listed basis, and only to the extent that it applies. A controller cannot treat a preferred business purpose as a legal basis.
Six listed bases
The bases are consent, contract, legal obligation, vital interests, public interest or official authority, and legitimate interests subject to the stated override.
Public authorities
Article 6(1)(f), legitimate interests, does not apply to processing by public authorities in the performance of their tasks.
A later purpose
Article 6(4) requires a compatibility assessment in the stated circumstances, considering purpose links, context, data nature, consequences, and safeguards.
5. Articles 7 and 8: Conditions for Consent and Child Consent
Proof and presentation
Where consent is the basis, the controller must be able to demonstrate it. A consent request within a broader written declaration must be distinguishable and clear.
Withdrawal
Consent may be withdrawn at any time. The withdrawal does not undo prior lawful consent-based processing, and it must be as easy to withdraw as to give.
Freely given?
Article 7(4) requires utmost account to be taken of whether a contract or service is conditional on consent to unnecessary processing.
Children and services
For information society services directly offered to a child, Article 8 uses age 16, subject to a Member State lower age that cannot be below 13.
6. Articles 9-11: Sensitive Data, Criminal Data, and Identification
Article 9 starts with prohibition
Special-category data processing is prohibited by Article 9(1), unless one of the Article 9(2) conditions applies. A general Article 6 basis alone does not state the whole rule.
Exceptions are conditional
Article 9(2) lists distinct circumstances, including explicit consent, employment-law settings, vital interests, legal claims, public interests, health, and Article 89(1) purposes.
Criminal-conviction data
Article 10 requires official-authority control or authorisation by Union or Member State law with appropriate safeguards; comprehensive conviction registers have an additional limit.
No unnecessary identification
Article 11 does not force a controller to collect extra identifying information solely to comply. But a person may provide information enabling identification to exercise Articles 15-20.
Quiz 1: Find the Correct Article 6 Analysis
A city authority processes residents' addresses to carry out an official waste-collection task assigned to it. Which statement most accurately follows Article 6?
Which answer is correct?
- The authority may rely on legitimate interests under Article 6(1)(f) whenever collecting addresses is useful.
- Processing may be necessary for a task carried out in the public interest or in the exercise of official authority, while the legal basis for Article 6(1)(e) processing shall be laid down by Union or Member State law.
- The authority must always obtain consent because addresses are personal data.
- Article 6 permits any later use of the addresses if the authority originally collected them lawfully.
Show Answer
Answer: B) Processing may be necessary for a task carried out in the public interest or in the exercise of official authority, while the legal basis for Article 6(1)(e) processing shall be laid down by Union or Member State law.
Article 6(1)(e) covers processing necessary for a public-interest task or official authority. Article 6(3) says the basis for Article 6(1)(e) processing shall be laid down by Union or Member State law. Article 6(1)(f) does not apply to public authorities when performing their tasks, and Article 6(4) may require a compatibility assessment for further processing.
7. Article 12: Transparent Communication, Requests, Time Limits, and Cost
Communication quality
Article 12(1) requires information and communications in a concise, transparent, intelligible, easily accessible form using clear and plain language.
Facilitate rights
The controller shall facilitate Articles 15-22 rights. In Article 11(2) cases, refusal requires demonstration that the controller cannot identify the requester.
The standard and extension deadlines
Action information is due without undue delay and within one month. A necessary extension may add two months for complexity and number of requests.
Cost and refusal
The default is free of charge. A reasonable fee or refusal is allowed only for requests that are manifestly unfounded or excessive, with the burden on the controller.
8. Article 12 Timeline Lab: Responding to an Access Request
Day 0: March 3
An Article 15 request received on March 3 activates Article 12(3). The controller must provide information on action taken without undue delay and within one month.
Normal deadline: April 3
The one-month outer deadline is April 3. Complexity alone is not the complete rule: an extension must be necessary and reflect complexity and number of requests.
Extension notice
A valid two-further-month extension still requires notice to the data subject within the initial month, together with the reasons for the delay.
Identity and excessive requests
Reasonable doubts can justify necessary identity-confirmation information. Fees or refusal require the controller to demonstrate manifestly unfounded or excessive requests.
9. Articles 13 and 14: Direct Collection versus Indirect Collection
Direct collection: Article 13
When the controller collects data from the data subject, Article 13 requires the listed information at the time when personal data are obtained.
Article 13 content
Information includes identity, contacts where applicable, purposes, legal basis, legitimate interests where relevant, recipients, transfers, storage, rights, and other listed matters.
Indirect collection: Article 14
When data were not obtained from the person, Article 14 adds categories of data and source information, including whether the source was publicly accessible.
Article 14 timing
The general deadline is a reasonable period after obtaining data, at the latest within one month, subject to earlier first-communication or first-disclosure triggers.
10. Articles 13-15 in Practice: A Data Broker and a Student Request
A purchased list is indirect collection
A platform buying student details from another party should begin with Article 14, including the required data categories and source information.
The first-contact trigger
If the platform emails a student before one month has passed, Article 14 requires the information at the latest at the time of that first communication.
Access asks two questions
Article 15 lets the student ask whether processing occurs and, if it does, obtain access to data plus the listed contextual information.
A copy, with a limit
The controller shall provide a copy of data undergoing processing. But the right to obtain that copy shall not adversely affect rights and freedoms of others.
Flashcards: Exact Rules to Recall
Flip each card and test whether you can identify the Article, trigger, and qualification before reading the answer.
- Article 5(2): What is accountability?
- The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability').
- Article 6(1): What is the lawfulness threshold?
- Processing shall be lawful only if and to the extent that at least one of the following applies.
- Article 7(3): What is the withdrawal usability rule?
- It shall be as easy to withdraw as to give consent.
- Article 8(1): What is the default child-consent age for direct information society services?
- The processing of the personal data of a child shall be lawful where the child is at least 16 years old. A Member State lower age may not be below 13.
- Article 12(3): What is the normal request deadline?
- Without undue delay and in any event within one month of receipt of the request.
- Article 14(3)(a): What is the general indirect-collection deadline?
- Within a reasonable period after obtaining the personal data, but at the latest within one month.
- Article 15(3): What must the controller provide?
- The controller shall provide a copy of the personal data undergoing processing.
Quiz 2: Direct, Indirect, and Access Duties
A retailer obtains a customer's email address directly through an online checkout form. Six weeks later, it plans to use that email address for a different purpose. Which statement best reflects Articles 13 and 15?
Choose the best answer.
- Because the retailer collected the email directly, Article 14 always requires it to provide all information within one month.
- Article 13 requires the relevant information at the time the data are obtained; before further processing for another purpose, Article 13(3) requires information on that other purpose and relevant further Article 13(2) information.
- The retailer can never process the email for another purpose after collection.
- The customer can receive only a yes-or-no answer to an Article 15 request, not a copy of personal data.
Show Answer
Answer: B) Article 13 requires the relevant information at the time the data are obtained; before further processing for another purpose, Article 13(3) requires information on that other purpose and relevant further Article 13(2) information.
Article 13 governs direct collection and requires specified information at the time data are obtained. Article 13(3) applies where the controller intends further processing for another purpose. Article 14 is for data not obtained from the data subject. Article 15 provides confirmation, access, listed information, and a copy under Article 15(3), subject to Article 15(4).
Key Terms
- controller
- The party to which Articles 5-15 assign responsibilities such as demonstrating compliance, providing information, facilitating rights, and providing copies.
- lawfulness
- Under Article 6(1), processing is lawful only if and to the extent that at least one listed legal basis applies.
- data subject
- The natural person whose personal data are being processed and who holds the rights described in Articles 12-15.
- accountability
- Article 5(2)'s requirement that the controller be responsible for, and able to demonstrate compliance with, Article 5(1).
- right of access
- The Article 15 right to obtain confirmation about processing and, where processing occurs, access to personal data and the specified information.
- data minimisation
- The Article 5 principle that personal data are adequate, relevant, and limited to what is necessary for the processing purposes.
- direct collection
- A situation governed by Article 13, where personal data relating to a data subject are collected from that data subject.
- purpose limitation
- The Article 5 principle that data are collected for specified, explicit, and legitimate purposes and are not further processed incompatibly with them.
- indirect collection
- A situation governed by Article 14, where personal data have not been obtained from the data subject.
- copy of personal data
- The Article 15(3) entitlement requiring the controller to provide a copy of the personal data undergoing processing, subject to the rights and freedoms of others.
- information society services
- The service context named in Article 8 for its child-consent rule; Article 8 applies where Article 6(1)(a) applies and such services are offered directly to a child.
- special categories of personal data
- The Article 9(1) categories subject to a prohibition unless an Article 9(2) condition applies.