Recital 36

Article 13 of Regulation (EU) 2016/679 requires the controller to provide the data subject with certain information on the processing of his or her personal data as well as certain further information necessary to ensure fair and transparent processing, as defined in paragraphs 1, 2 and 3 of that provision. According to paragraph 4 of Article 13 of Regulation (EU) 2016/679, that obligation does not apply where and insofar as the data subject already has the information. To further reduce the burden of controllers, without undermining the possibilities of the data subject to exercise his or her rights under Chapter III of that Regulation, this derogation should be extended to situations where the personal data have been collected in the context of a direct and clearly circumscribed relationship between a data subject and a controller exercising an activity that does not involve processing a large amount of personal data, where the processing is not likely to result in a high risk, within the meaning of Article 35 of that Regulation, and there are reasonable grounds to believe that the data subject already has the information referred to in points (a) and (c) of paragraph 1 of Article 13 in the light of the context in which the personal data have been collected. A direct and clearly circumscribed relationship is established for instance where the controller and the data subject interact directly in a specific occasion , such as the relationship between a craftsman and their clients.

The application of the derogation from the information obligation should not undermine the principle of transparency and should be limited to situations where the controller has reasonable grounds to believe that the data subject already possesses the required information. These should be the situations where the personal data are collected in the context of a direct and clearly circumscribed relationship between data subjects and a controller and does not involve the processing of a large amount of personal data, and where the scope of processing is limited to the minimum data necessary to perform the service. In such cases , it should be reasonable to expect, for instance, that the data subject has the information on the identity and contact details of the controller, as well as on the purpose of processing . The same should apply, under the aforementioned conditions, to associations and sport clubs where the processing of personal data is confined to the management of membership, communication with members and the organisation of activities. Nevertheless, this derogation from the obligations of Article 13 is without prejudice to the independent obligations of the controller under Article 15 of that Regulation, which applies in case the data subject requests access based on the latter provision. This derogation should only apply to processing operations which are foreseeable and non-complex, which is not the case in the field of employment or in relations with public authorities or public bodies or private entities for the performance of a task in the public interest. Where the derogation from the obligations of Article 13 does not apply, in order to balance the need for completeness and easy understanding by the data subject, controllers may adopt a layered approach when providing the information required, notably by allowing users to navigate to further information.