What Needs to be Done Prior to Collection

Contact the data subject

Contact the Data Protection Authority

Article 33

1. Where personal data is to be obtained from a data subject, the responsible party shall provide the data subject with the information referred to under (2) and (3) prior to obtaining the said personal data, unless the data subject is already acquainted with this information.

2. The responsible party shall inform the data subject of its identity and the purposes of the processing for which the data is intended.

3. The responsible party shall provide more detailed information, where given the type of data, the circumstances in which they are to be obtained or the use to be made thereof, this is necessary in order to guarantee with respect to the data subject that the processing is carried out in a proper and careful manner.

Contact the Data Protection Authority

Section 1 Notification

Article 27

1. The fully or partly automated processing of personal data intended to serve a single purpose or different related purposes, must be notified to the Data Protection Commission or the officer before the processing is started.

2. The non-automated processing of personal data intended to serve a single purpose or different related purposes, must be notified where this is subject to a prior investigation.

Article 28

1. The notification shall contain the following particulars:

a. the name and address of the responsible party;

b. the purpose or purposes of the processing;

c. a description of the categories of data subjects and of the data or categories of data relating thereto;

d. the recipients or categories of recipients to whom the data may be supplied;

e. the planned transfers of data to countries outside the European Union;

f. a general description allowing a preliminary assessment of the suitability of the planned measures to guarantee the security of the processing, in application of Articles 13 and 14.

2. The notification shall include the purpose or purposes for which the data or categories of data have been or are being collected.

3. Changes in the name or address of the responsible party must be notified within one week.

Changes to the notification which concern (1)(b) to (f) shall be notified in each case within one year of the previous notification, where they appear to be of more than incidental importance.

4. Any processing which departs from that which has been notified in accordance with the provisions of (1) (b) to (f) shall be recorded and kept for at least three years.

5. More detailed rules can be issued by or under general administrative regulation concerning the procedure for submitting notifications.