QuestionQ15

Compliance with European Data Protection Law and Regulation

A Spanish electricity customer contacts her local supplier with questions about the company’s planned merger. In particular, she wants to know which recipients her personal data will be disclosed to after the merger is completed. Under Article 13 of the GDPR, what must the company do before giving the customer the requested information?

  • A Verify that the request is applicable to the data collected before the GDPR entered into force.
  • B Verify that the purpose of the request from the customer is in line with the GDPR.
  • C Verify that the personal data has not already been sent to the customer.
  • D Verify that the identity of the customer can be proven by other means.
Explanation

GDPR Article 13 requires controllers to provide information about the recipients or categories of recipients of personal data. When responding to a data subject, Article 12 permits the controller, where it has reasonable doubts about the requester’s identity, to obtain information needed to confirm that identity before disclosing personal-data information.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!