CIPP/E: Certified Information Privacy Professional/Europe

By IAPP · Question Mode

QuestionQ15

Compliance with European Data Protection Law and Regulation

A Spanish electricity customer contacts her local supplier with questions about the company’s planned merger. In particular, she wants to know which recipients her personal data will be disclosed to after the merger is completed. Under Article 13 of the GDPR, what must the company do before giving the customer the requested information?

Explanation

GDPR Article 13 requires controllers to provide information about the recipients or categories of recipients of personal data. When responding to a data subject, Article 12 permits the controller, where it has reasonable doubts about the requester’s identity, to obtain information needed to confirm that identity before disclosing personal-data information.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!