Key References:

  • Art. 5(1)(a)
  • Arts. 6, 13, 14.
  • Recital 39

Art. 5

1. Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

Lawfulness:

  • Personal data is processed according to specific lawful basis (or bases) as identified in Art. 6 (1) (a) to (f).

Fairness:

  • The GDPR does not link a specific article to the principle of fairness.
  • The EDPB Guidelines 2/2019 point to Article 8(2) of the Charter of Fundamental Rights in order to clarity the principle of fairness.
    • Article 8(2) of the Charter of Fundamental Rights states that, “[s]uch data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.”
  • It would seem that the principle of fairness includes, at the very least, a) the identification of lawful basis under Art. 6 (1), b) lawfulness of consent under Art. 7, and c) fulfillment of DSAR rights under Arts. 12-22.

Transparency:

  • Pursuant to the transparency obligations identified in Arts. 13 to 14 data subjects are informed about collection and processing of their personal data.