GDPR – How to inform data subjects?

STARTUPS, LEARN HOW TO INFORM YOUR USERS!

Informing data subjects is mandatory if your startup processes personal data. The GDPR requires clear and precise information. How do I inform the people whose personal data I process? What information do I need to pass on?

1. WHAT OBLIGATIONS DOES THE GDPR IMPOSE?

Pursuant to Articles 13 (direct collection) and 14 (indirect collection) of the GDPR, the data controller has an obligation to inform data subjects of the processing(s) carried out on their personal data when such data is collected directly from the data subject or when the data is collected indirectly (example: public data or on social networks).

2. WHAT INFORMATION MUST THE COMPANY PASS ON TO THE PERSONS CONCERNED?

Pursuant to the GDPR, the information that must appear within an information notice is as follows:

• Identity and contact details of the data controller
• Where applicable, identity and contact details of the data controller’s representative
• If applicable, contact details of the Data Protection Officer (“DPO”)
• Purposes of processing
• Legal basis for processing (consent, performance of a contract, compliance with a legal obligation, etc.)
• Whether the collection of personal data is mandatory or optional and the consequences for the individual in the event of failure to provide data
• Where applicable, the legitimate interests of the controller or third party, if the processing is necessary for the purposes of those legitimate interests.
• Recipients or categories of recipients of personal data, if any
• Details of data transfers to third countries and associated guarantees
• Length of time personal data is kept, or criteria for determining this length of time
• Mention of each of the rights of data subjects (access, rectification, erasure, limitation of processing, opposition and portability, etc.).
• Right to withdraw consent at any time, if applicable
• Mention of the right to lodge a complaint with a supervisory authority
• Mention of automated decision-making, if any, including profiling
• In the case of indirect data collection: categories and source of data collected

Warning : Startups processing the personal data of individuals located in France: beware of the application of article 116 of the French Data Protection Act. This article imposes an information notice on the bottom of forms and questionnaires. This information, often found below contact forms on websites, must specify :

• whether answers are mandatory or optional;
• the identity of the data controller and, where applicable, that of its representative;
• the purpose(s) of the processing for which the data is intended;
• the rights of data subjects (e.g., the right to access, rectify and delete their personal data).

3. WHAT FORM CAN THIS INFORMATION TAKE?

While the GDPR does not impose any information medium, these notices must be legible, easily accessible, clear and understandable. For employees, this may take the form of a provision in the employment contract, an e-mail sent individually to each employee, a notice posted on employee information panels, or an information notice on the company intranet or in a file accessible to all employees.

In the case of partners, service providers and shareholders, this may take the form of a notice appearing in contracts, or at the bottom of e-mails, letters or collection forms sent to them.

This information can therefore take the form of :

• a Confidentiality policy for the processing of personal data carried out via a website,
• an internal policy for employees,
• information at the bottom of forms, quotes or emails;
• in a personal data protection clause in employment, customer or service provider/supplier contracts.

4. OUR ADVICE

Our advice:

• Avoid copying existing privacy policies that are not adapted to the personal data processing carried out by your startup and that are sometimes not updated;
• Choose a format that is legible, understandable and easily accessible;
• Use simple, clear terms;
• Provide information at different stages of the user journey;
• Prioritize information and communicate it to the person concerned when their account is created, directly on the registration page;
• On the same page, provide a link to a complete information notice (e.g. hypertext link to a Privacy Policy);
• Update information notices.

5. WHAT ARE THE PENALTIES?

Personal data protection authorities can carry out remote checks and therefore sanction a startup if its website does not properly inform data subjects!

The penalties under the GDPR for failing to inform data subjects are 4% of the startup’s annual worldwide sales or 20 million euros in fines (whichever is higher).

References :

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

• Guidelines, recommendations and best practices published by the European Data Protection Committee (EDPS);

• Article 29 Working Party (G29) guidelines approved by the EDPS.