Collection #8
Description
Collection
Collection is a form of processing that always involves personal data.
It involves obtaining personal data directly from the data subject. The process must be carried out explicitly with their knowledge and through their personal actions in written, verbal, explanatory form or by means of non-verbal behavior.
In addition to the active part of the data subject, the collection requires an active, subjective action on the part of the procuring body and must therefore not be carried out by the controller in the sense of “growing”. In addition, the collection must be necessary for one or more specified, explicit and legitimate purposes. The method of data collection itself is irrelevant.
In addition, the obligation to inform the data subject in accordance with Art. 13 GDPR must be observed.
If the data was collected without the knowledge of the data subject, subsequent notification (Art. 19 GDPR) is required. If, on the other hand, the data was collected unlawfully, it may not be used or stored. If the data has already been stored, the personal data must be deleted immediately for this reason.
Furthermore, since collection is a sub-aspect of processing, the conditions for this must also be fullfilled.
Related Comments
Based On
Art. 4 Nr. 2
Art. 5 Para. 1 lit. b
Comm. Art. 4 Rn. 35-41