The user requires an understanding of why personal data is collected. Information should be provided on the purpose for which data is collected. The General Data Protection Regulation (Regulation (EU) 2016/679) defines ‘personal data’ to ‘any information relating to an identified or identifiable natural person’, like name, date of birth, address or information about the use of websites, products, and services.
Furthermore the GDPR identifies certain special categories of personal data, which are also often referred to as sensitive data like biometric data and health information.
There must be a clear communication of which data is considered as personal information and which is not. If applicable, the user should also be informed about different data categories.
Main Question
Is the purpose of the data collected made clear, especially to the data subjects?
Sub-Questions:
- Is the customer informed about the data that is considered as personal, and the categories into which it is divided?
- Is the customer informed about the purpose for which data is shared with, third parties (categories of third parties) and the identity of the company (group of companies) that governs data processing?
- Is this information made clearly available and easily accessible (contract, website, manual, etc.)?
- Are contact points (such as customer service websites, emails, and addresses) for the customer maintained?