A controller omits data-subject rights from its privacy notice because "those rights are already written in the GDPR." Why is that insufficient?
Select an answer to reveal the explanation.
Short Explanation
"It's in the statute somewhere" is not a privacy notice. People should see their rights—access, erasure, objection, complaint to a DPA—spelled out where they actually look. Pointing at the Official Journal is not the same as informing them.
Full Explanation
Articles 13 and 14 expressly require information about data-subject rights and about the right to lodge a complaint with a supervisory authority. Pointing people to “read the GDPR yourself” does not discharge the controller’s duty to inform. Notices exist so individuals—residents dealing with civic services or customers of private firms—can see, in one place, access, rectification, erasure, restriction, portability, objection, withdrawal of consent where relevant, and how to complain without first becoming GDPR scholars.
Rights information is not limited to non-EU controllers. Naming rights in a notice does not waive Article 6 lawful-basis duties. Supervisory complaint rights are not gated on BCR approval; complaint pathways exist independently of transfer tools.
Exam caveat: list rights that actually apply to the processing (e.g., portability is narrower than access). Still, omitting the entire rights block because the Regulation exists somewhere online is always insufficient.
Operational check: ensure the live notice includes rights and SA complaint information with working contact routes, train support staff to recognise rights requests, and confirm the complaints section names how to reach a supervisory authority without forcing users to hunt through legal PDFs.