When do you need a 'privacy statement'?

Everyone who ventures onto the Internet will regularly come across a so-called 'privacy statement'. However, not everyone knows where the privacy statement comes from and when their company or organisation may or may not need a privacy statement.

This article broadly outlines the background to the privacy statement and when using a privacy statement may or may not be necessary or useful for a company or organisation.

What is a privacy statement?

A privacy statement is a statement usually, but not always, published online, in which a company or organisation publicly discloses in one place information about its processing of personal data within the meaning of the EU General Data Protection Regulation 2016/679 (hereinafter "GDPR").

A privacy statement may relate to the processing of personal data in the context of one specific digital service, which may mean that companies or organisations offering or operating multiple digital services have multiple privacy statements, but it may also be generally designed to cover all processing activities of a particular entity.

A privacy statement is a unilateral statement from a particular entity for information purposes. A privacy statement is therefore not a contract, nor is it about asking permission for the processing of personal data. Asking or giving 'consent' to a privacy statement is therefore legally incorrect, although in practice the mistake of asking a counterparty to give consent to a privacy statement occurs more often. Although legally incorrect and absurd, the chance that making this mistake entails a significant legal risk is not very high. Nevertheless, it is advisable to handle the privacy statement in the correct manner and to connect to the legal framework behind the instrument of the privacy statement.

What is the legal background to the privacy statement?

A privacy statement is a means of fulfilling the information obligation of the responsible party in the sense of the GDPR.

One of the principles governing the processing of personal data is that personal data must be processed in a way that is lawful, proper and transparent towards the person to whom the personal data relates ("the data subject"). Pursuant to Article (2) GDPR, the Controller is responsible for compliance with the transparency principle laid down in Article 5 (1) GDPR.

The transparency principle is further elaborated in the GDPR, in particular in the obligations from Articles 12, 13 and 14 GDPR from the third chapter of the GDPR. A chapter that concerns the rights of the data subject under the GDPR.

What should a privacy statement contain?

The GDPR prescribes which information must be provided to the data subject. The privacy declaration should therefore contain a number of elements.

Article 12 of the GDPR states that the Controller shall take appropriate measures to ensure that the data subject receives the information and communication referred to in relation to the processing of his or her personal data in a concise, transparent, intelligible and easily accessible form, and in clear and plain language, in particular where the information is specifically addressed to a child.

The data subject should be informed in a concise, transparent and accessible form and in clear and simple language about:

• the identity and contact details of the Controller and of the Controller's representative;
• the contact details of the Data Protection Officer;
• the purposes for which the personal data are intended;
• the legal basis for the processing;
• the legitimate interests of the Controller or of a third party, if the processing is based on this legal ground;
• the recipients or categories of recipients of the personal data;
• Whether the Controller intends to transfer the personal data to a third country or an international organisation; whether or not there is an adequacy decision by the Commission; or, in the case of transfers outside the EU/EEA on other grounds, what appropriate or suitable safeguards are in place, how to obtain a copy or where to access them;
• the period for which the personal data will be stored or, if this is not possible, the criteria for determining that period;
• that the data subject has the right to request from the Controller access, rectification or erasure of personal data or restriction of processing concerning him or her, as well as the right to object to the processing and the right to data portability;
• where processing is based on consent, that the data subject has the right to withdraw the consent at any time, without affecting the lawfulness of the processing based on consent before the withdrawal;
• that the data subject has the right to lodge a complaint with a supervisory authority, in the Netherlands this is the Dutch Data Protection Authority “Autoriteit Persoonsgegevens”;
• whether the supply of personal data is a legal or contractual obligation or a necessary condition for the conclusion of a contract, and whether the data subject is under an obligation to provide the personal data and what the consequences might be if the data are not provided;
• the existence of automated decision making, including profiling, and, at least in those cases, useful information on the underlying logic as well as the significance and expected consequences of such processing for the data subject.

Where personal data has not been obtained from the data subject itself, the Controller shall also provide the data subject with the following information:

• the categories of personal data concerned;
• the recipients or categories of recipients of the personal data;
• The source from which the personal data comes and whether it comes from public sources;

In practice, it is notable that a description of the purposes, the legal basis and the precise 'legitimate interests', if 'legitimate interests' is one of the grounds for processing, are sometimes missing in the privacy statement.

Another potential point of attention is the use of 'hyperlinks' in a privacy statement to other web pages with more detailed information, sometimes published by third parties. Especially with links to information published by third parties, the risk arises after some time that the link is no longer 'up'. It is therefore wise to be cautious when using links, to regularly check whether the link is still 'in the air' and in any case to copy the legally required information available via the link in the text of the privacy statement itself.

Who needs a privacy statement?

The privacy statement is particularly useful when the Controller has little or no direct contact with data subjects and cannot make the information required to be provided accessible by other means. The provider of a publicly available digital service that is offered completely remotely to, in theory, thousands, hundreds of thousands, millions, or even billions of partly anonymous people is an example of a party for whom it will not be possible to provide the required information to each person personally.

A single online privacy statement on a website that is visible and easily accessible to everyone is a solution in such a situation.

When do I not need a privacy statement?

The Controller is obliged to actively provide certain information under the GDPR. Nevertheless, in practice it often happens that Processors, or parties that will be Processors in most cases, such as ICT suppliers and the web- or app developers of digital services on behalf of another party, also publish a privacy statement.

There are various reasons why it may also be desirable for a Processor to have a privacy statement. For example, for practical reasons, out of respect for the data subjects, or to assist the Controller. In such a situation, it is important that the privacy statement does not falsely create the impression that the Processor is a Controller.

A privacy statement is also not necessary if the information can be provided to the data subject by other means. Article 12 (1) of the GDPR states that the information shall be provided in writing or by other means, including electronic. If the data subject requests it, the information may be provided orally, provided that the identity of the data subject is proved by other means.

Furthermore, the obligation to provide information does not apply at all if and insofar as the data subject already has the information. In addition, the obligation to provide information does not apply if providing it proves impossible or would involve a disproportionate effort. In particular with regard to processing for archiving in the public interest, scientific or historical research or statistical purposes, or in so far as the obligation would make it impossible or would seriously jeopardise the achievement of the purposes of such processing.

The obligation to provide information shall also not apply if the acquisition or communication of the data to the Controller is expressly laid down by law and that law provides for appropriate measures to protect the legitimate interests of the data subject, or the personal data must remain confidential pursuant to professional secrecy.

Do I need a privacy statement for my employees?

The employer who determines the purposes and means of the processing of personal data of an employee, usually in the context of the performance of an employment contract or similar legal relationship, is a Controller in the sense of the GDPR. Therefore, the employer is also subject to the information obligations of the GDPR, as they apply to any Controller in the sense of the GDPR. Incidentally, the content or interpretation of obligations from the GDPR for an employer in the role of Controller may sometimes be different, particularly in connection with the presumption of the existence of an unequal power relationship between employer and employee. However, the information obligations set out in Articles 12, 13 and 14 of the GDPR do not particularly differ for an employer in the role of Controller.

It is not compulsory to use a privacy statement as a means of informing employees. Indeed, a privacy statement for employees is less likely to be an obvious means of meeting the information obligation. After all, one of the differences between an employer and other Controllers is that employer and employee usually have much more opportunity for personal contact and for conveying the information that is required to be provided.

It is generally wise, however, to explicitly address privacy-related issues in existing employment-related documentation, such as employment contracts, personnel handbooks, (ICT, Social Media or Camera) Protocols, internal policy documents, etc. In any case, insofar as the activities in and around the work can have an impact on the employee's privacy. Depending on the type of activities, the layout of the location where and the means by which the activities are carried out, and other circumstances, the risk to the employee's privacy will increase or decrease.

What happens if I have no or an incomplete privacy statement?

If you are the Controller and provide the data subject with the information as required under Articles 12, 13 and 14 of the GDPR, it generally does not matter which way and in which form the information is provided. Depending on the circumstances and facts of the case, not having a privacy statement does not have to result in an infringement of the GDPR.

However, if the mandatory information is not demonstrably provided in another more obvious way, in a concise, transparent and accessible form in clear and simple language, or not provided at all, then this may constitute a breach of the GDPR, which may have legal consequences.

Under Article 83(5)(b) of the GDPR, the maximum fine for failure to comply with the obligation to provide information to the data subject that a supervisory authority may impose is an administrative fine of up to €20,000,000 or, in the case of a business, up to 4% of its total annual worldwide turnover in the preceding business year, whichever is higher. In the Netherlands, the national data protection authority is the 'Autoriteit Persoonsgegevens'.

Also, under the ground for liability in Article 82 GDPR, any person who has suffered material or immaterial damage as a result of a breach of the GDPR may claim compensation for the damage suffered from a Controller or a Processor.

What is the difference between a privacy statement and a cookie statement?

The privacy statement often appears together with a cookie statement, sometimes both statements are even in the same text. The cookie statement and the privacy statement have much in common. The cookie statement is also a unilateral statement that is used as a useful means of complying with an obligation to actively provide information pursuant to the law, particularly when this information cannot be provided in any other way because there is little direct contact or because there are potentially very many individual users of a publicly available electronic communications service within the meaning of the Dutch Telecommunications Act.

The main difference, however, is that the information obligation that the cookie statement aims to meet, the so-called 'Cookie Act', is a provision within the Dutch Telecommunications Act and not the GDPR.

The relevant chapter of the Dutch Telecommunications Act entitled "Chapter 11 Protection of Personal Data and Privacy" has been aligned with and brought into concordance with the GDPR.

However, partly because this concerns two different statutory information obligations from two very different legal frameworks, it is generally wise in practice to keep the cookie statement and the privacy statement separate and to sharply distinguish them, even though the two statements are often combined.

Conclusion

A Controller needs a privacy statement if this instrument is the only means by which the Data Controller can comply with the active information obligations towards the data subject under the GDPR. For example, because the Controller offers a digital service with little or no personal contact with data. If the Controller does not comply with this information obligation, the Controller risks fines or liability under the GDPR.

The GDPR prescribes the information to be provided and that it must be in a concise, transparent and accessible form and in clear and simple language. The information may be provided in writing or by other means, including electronic. If the data subject so requests, the information may also be provided orally.

A privacy statement is a unilateral statement in which a company or organisation provides information about the processing of personal data within the meaning of the GDPR in one central location. The privacy statement is a 'form' in which information can be provided. A privacy statement is not a contract or a request for consent and is therefore not susceptible to 'approval' by another party. A privacy statement can also be a useful tool even if other methods are available, for example because it is practically the most obvious way to provide the information in this form.

An employer in the role of Controller will usually have contact with employees and be able to provide the necessary information without a privacy statement. Existing labour related documentation, such as employment contracts or personnel manuals, may be suitable for this purpose. In smaller organisations, providing information orally is also less likely to be too difficult.

The cookie statement is comparable to the privacy statement and is often published together with it. However, the statutory information obligation behind the information in a cookie statement stems from the Dutch Telecommunications Act, specifically the so-called "Cookie Act" included therein. Both regulations are in concordance with one another, but it is generally wise to keep both statements apart due to the different origin of the statutory information obligations. Nevertheless, it is permitted to include the information in one statement, and in practice a combination of both statements into one does occur.

Processors can also provide information to the data subject, whether or not on behalf of the Controller, via a privacy statement. In practice, it often happens that Processors, for example app or website developers, also provide the privacy statement. In the latter case, it is important that the Processor does not create the false impression that he is the Controller, but clearly indicates that he is assisting the Controller in informing the data subject or that the Processor wishes to inform the data subject out of respect to the data subject.

Advice

Does your company or organisation have a privacy statement and/or other privacy-related documentation? Have privacy-related documentation drawn up or checked.

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!