Article 13

Information to be provided when personal data are collected from the data subject

1. When personal data concerning a data subject are collected from that person, the controller shall already provide the data subject with the following information when obtaining the personal data:

2. A

   the identity and contact details of the controller and, where appropriate, of the controller's representative;

3. B

   where applicable, the contact details of the data protection officer;

4. C

   The processing purposes for which the personal data are intended, as well as the legal basis for the processing;

5. D

   the legitimate interests of the controller or of a third party, if the processing is based on Article 6(1)(f);

6. E

   where applicable, the recipients or categories of recipients of the personal data;

7. F

   where appropriate, that the controller intends to transfer the personal data to a third country or an international organization; whether or not there is an adequacy decision by the Commission; or, in the case of transfers referred to in Article 46, Article 47 or Article 49(1), second subparagraph, what the appropriate or suitable safeguards are, how to obtain a copy of them or where to consult them.

• 2

  In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following additional information when obtaining the personal data in order to ensure proper and transparent processing:

• A the period for which personal data will be stored, or if that is not possible, the criteria for determining that period;

• B that the data subject has the right to request from the controller access to and rectification or erasure of personal data or restriction of the processing concerning him, as well as the right to object to the processing and the right to data portability;

• C where the processing is based on Article 6(1)(a) or Article 9(2)(a), that the data subject has the right to withdraw the consent at any time, without prejudice to the lawfulness of the processing based on the consent before its withdrawal;

• D that the data subject has the right to complain to a supervisory authority;

• E whether the provision of personal data is a legal or contractual obligation or a necessary condition to enter into a contract, and whether the data subject is obliged to provide the personal data and what the possible consequences are if the data are not provided;

• F the existence of automated decision-making, including the profiling referred to in Article 22(1) and (4), and, at least in those cases, useful information on the underlying logic, as well as the significance and expected consequences of such processing for the data subject.

• 3

  Where the controller intends to further process the personal data for a purpose other than that for which the personal data have been collected, the controller shall, prior to such further processing, provide the data subject with information about that other purpose and any relevant further information referred to in paragraph 2.

• 4

  Paragraphs 1, 2 and 3 do not apply when and to the extent that the data subject already has the information.