Blog

What they are and what must they include

You probably hear the term privacy notice quite a lot, but do you know what one is? Simply put a privacy notice gives an individual specific information about what you will do with their personal data when they hand it over to you.

If, as part of your business activities, you collect and use someone’s personal data you have a legal obligation under the General Data Protection Regulation (GDPR) to provide them with a privacy notice.  A privacy notice is one of the main documents you must have for GDPR compliance. It helps to fulfil your transparency obligation whereby you are open, honest and upfront with an individual about what you do with their personal data.

Okay, so you now know you must provide a privacy notice to individuals but what exactly do you need to include in a privacy notice?  Well, quite a bit actually! Plus, it depends on how you have obtained the personal data about the individual as to what is to be included in a privacy notice.

Privacy notice when collecting data directly from an individual

When you collect personal data directly from the individual, you must provide them with the following details:

• Your business name and contact details – so the individual knows who is processing their data and can get in touch with you
• The name and contact details of your representative – only applicable if your based outside the EU and you offer services/goods to EU citizens
• The contact details of your Data Protection Officer – only applicable if you are required to appoint a DPO
• The purposes of the processing – so the individual knows exactly what you will be doing with their data
• The lawful basis for the processing – so the individual knows which lawful basis you are relying on to process their data and/or special category data for each processing activity you undertake
• The legitimate interests for the processing – so the individual knows what your legitimate interests are to process their data and how their rights are not out-weighed by those interests (only applicable if you rely on the legitimate interest lawful basis for a processing activity)
• The recipients of the personal data – so the individual knows who you will share their data with, this includes anyone who you instruct to process personal data on your behalf
• The details of transfers of the personal data to any country outside the EU or to international organisations – so the individual knows the safeguards that are in place for the transfer to be made (only applicable if transfers outside the EU are made)
• The retention periods for the personal data – so the individual knows how long you will keep their data for
• The rights the individual has in relation to your processing activities – so the individual knows which rights they can exercise, remember the rights an individual has differs depending on the lawful basis relied on to undertake your processing activity
• The right to withdraw consent – so the individual knows how they can withdraw their consent (only applicable if you have relied on this lawful basis)
• The right to make a complaint to the Information Commissioner’s Office (ICO) – so the individual knows how they can complain to the ICO if they believe you are not processing their data in line with relevant data protection laws
• Whether an individual is under a statutory or contractual obligation to provide the personal data to you – only applicable if you have relied on these lawful basis
• The details of any automated decision-making, including profiling – so the individual knows the logic involved in the process and the potential consequences of decision made (only applicable if you undertake any automated decision-making, including profiling)

This information must be given to the individual at the time you collect the personal data from them, not after you have obtained it and started to use it.

Privacy notice when collecting data from third parties or a public source

If you have collected someone’s personal data from a third party or a publicly available source you still need to provide a privacy notice to that person. Under GDPR you must give this privacy notice to the individual at the earliest of:

• One month from the date of collection; or
• The date on which you first communicate with the individual; or
• The date on which you disclose the personal data to someone else

The privacy notice you give to someone when you have obtained their personal data indirectly differs ever so slightly from a privacy notice you give to someone when you obtain their personal data directly.

From the list above the only thing you do not need to tell someone is if they are under a statutory or contractual obligation to provide their data.  However, you must also include in the privacy notice the following:

• The categories of personal data obtained about them – so the individual knows what types of information you have collected about them
• The source of the personal data – so the individual knows where you got their personal data from, including if it was from a publicly available source

So, you now know what information you must provide to an individual depending on whether you obtained their personal data directly or in-directly.  As ever with the law though there are always some exceptions to the rule and there are occasions when you don’t need to provide a privacy notice.  These are limited in scope so will only apply in exceptional circumstances.

Exceptions to providing a privacy notice

When you have collected personal data directly from the individual you don’t need to give them information that they already have.  Do remember though that you still must give them the information they don’t have!  It may therefore be difficult to rely on this exception as you might not know what information the person already has.  In practice it is much easier to give the individual the full privacy notice rather than trying to work out which parts not to include as.

The same applies to when you have collected personal data from another source about an individual – you don’t need to provide them with information they already have.  However, this will prove harder to do as you must check with the third party who gave you the individual’s personal data what information they provided in their privacy notice and what information related to your processing activities.  Therefore, it will be more practical and easier to simply provide your own privacy notice to the individual.

There are further exceptions to having to provide a privacy notice when you have obtained personal data from another source about an individual, these are:

• Providing the information would be impossible or would involve a disproportionate effort – Impossible means you have no contact details for the individual and you have no means of getting such details; and Disproportionate effort may apply when processing the data for archiving in the public interest, or for scientific, historical or research purposes.
• Providing the information would render impossible or seriously impair the achievement of the objectives of the processing – Your most likely scenario for this is when the personal data is used for investigatory purposes.
• When obtaining or disclosing the personal data is required by law.
• Where the personal data must remain confidential, subject to an obligation of professional secrecy regulated by law.

For most businesses it will be difficult to rely on these exceptions, therefore in most cases you must provide a privacy notice to an individual.

The easiest way to do this is to publish your privacy notice on your website, that way you can easily direct individuals to the privacy notice. Remember, though you will have to provide a privacy notice by other means to individuals who are not able to access the internet, for example you could send a printed copy of your privacy notice.

In the next parts of our Privacy Notice feature we will look in a bit more detail as to how to provide a privacy notice to individuals and how to write one.