The fourth principle of data protection law relates to transparency or recognizability.

In discussions about data protection, questions of transparency come up most frequently. Transparency means that the affected individual must be able to recognize what personal data has been collected about them and for what purpose it is being processed. This is required by § 15 of the Information and Data Protection Act. This transparency is derived from the good-faith principle, according to which processing of data concerning you that is not transparent (i.e. not recognizable to you) must be prevented unless creating transparency would seriously endanger the fulfillment of the legal task. However, this is only the case in exceptional circumstances, such as in the field of criminal prosecution. For such cases, the relevant laws allow, for example, to open a criminal investigation and to postpone the notification of this opening to the affected individual.

There are two additional special rules regarding transparency that are set forth in § 15 IDG:

1. When personal data is being collected in a systematic way, such as with questionnaires, forms, or online recordings, the legal basis for the data collection and its intended purpose must be provided.
   
   
2. When special personal data is being obtained, the public institution is not only required to permit and facilitate transparency, but also to actively inform the affected individual of the purpose for the data processing. This applies as long as it does not seriously jeopardize the fulfillment of the legal tasks.

This information obligation will be expanded in the future owing to international legal requirements. The German Federal Data Protection Act, for example, extends this requirement to the obtaining of so-called regular personal data, and legislators for the Canton of Basel-Stadt will have to do the same in the next revision of the IDG. Then, in the near future, not only when obtaining special personal data, but also when obtaining ordinary personal data, the public institutions will be obliged to actively inform affected individuals about the processed data or the categories of processed data, the legal basis and purpose for the data processing, the recipients of the data, and the rights that the affected persons are entitled to. This can either be included as part of the relevant form or, if you are collecting the data during a conversation, by handing out an information sheet. Despite the new regulation, the effort involved is relatively limited.

Lizenz