Article 8 — Right to Information at Collection

1. 1.

   Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

   1. The identity and contact details of the controller and, where applicable, of the controller’s representative within the State.
   2. The contact details of the data protection officer, where one has been designated.
   3. The purposes of the processing for which the personal data are intended, as well as the legal basis for the processing pursuant to Article 4.
   4. Where processing is based on the legitimate interests of the controller or of a third party pursuant to Article 4, the specific legitimate interests pursued by the controller or by the third party.
   5. The recipients or categories of recipients of the personal data, if any.
   6. The period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period.
   7. The existence of the right to request from the controller access to and rectification or erasure of personal data, restriction of processing, the right to object to processing, and the right to data portability, in accordance with this Title.
   8. Where processing is based on consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
   9. The right to lodge a complaint with the competent supervisory authority of the State.
   10. Whether the provision of personal data is a requirement arising from law, from a contract, or a condition necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data.
2. 2.

   Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject, prior to that further processing, with information on that other purpose and with any relevant further information as referred to in paragraph 1.

3. 3.

   The information referred to in paragraphs 1 and 2 shall be provided in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. The information shall be provided in writing, or by electronic means where appropriate. When requested by the data subject, the information may also be provided orally, provided that the identity of the data subject is established by other means.

4. 4.

   Where the controller provides its services through electronic interfaces, the information required under this Article shall be made persistently available through those interfaces in a manner that is easily navigable and retrievable by the data subject at any time.

5. 5.

   The information required under this Article shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable fee taking into account the administrative costs of providing the information, or may refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.