Section 2

Information and access to personal data

Article 13

Information to be made available when personal data is collected from the data subject

1. 1)Where personal data concerning the data subject are collected from the data subject, the controller shall provide the data subject with all the following information at the time the personal data are obtained:

2. the identity and contact details of the data controller and (if applicable) its representative(s);

3. contact details of the data protection officer, if applicable (not applicable);

4. the purpose of the intended processing of personal data and the legal basis for the processing;

5. in the case of data processing based on Section F of Section 1 of Article 6, the legitimate interests of the data controller or of a third party;

6. where appropriate, the recipients of the personal data or categories of recipients (not applicable);

7. where appropriate, the fact that the controller intends to transfer personal data to a third country or an international organization, and the existence or absence of a Commission decision on adequacy, or in the case of Article 46, Article 47 or the second subparagraph of Article 49 (1); in the case of the communication referred to in paragraph 1, an indication of the appropriate and appropriate guarantees and a reference to the ways in which copies may be obtained or made available (not applicable);

8. 2)In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following additional information at the time the personal data are obtained in order to ensure fair and transparent processing:

9. the period for which the personal data will be stored or, where that is not possible, the criteria for determining this period;

10. n the right of the data subject to request from the controller access, rectification, erasure or restriction on the processing of personal data concerning him or her, and about the data subject’s right to data portability;

11. In the case of data processing based on Article 6 (1) (a) or Article 9 (2) (a), the right to withdraw the consent at any time, without prejudice to the lawfulness of the processing carried out on the basis of the consent (not applicable);

12. the right to file a complaint to a supervisory authority;

13. whether the provision of personal data is based on a legal or contractual obligation or a precondition for entering into a contract and whether the data subject is required to provide personal data and the potential consequences of failure to provide such data;

14. about the automated decision-making process referred to in Article 22 (1) and (4), including profiling, and the logic used and the significance and likely consequences for the data subject of such processing.

15. 3)Where the controller intends to further process personal data for purposes other than the purpose for which they were collected, the controller shall inform the data subject before such further processing and of any relevant additional information referred to in paragraph 2.

16. 4)Paragraphs 1, 2 and 3 shall not apply where data subject already has the necessary information.