A controller omits data-subject rights from its privacy notice because "those rights are already written in the GDPR." Why is that insufficient?
Select an answer to reveal the explanation.
Short Explanation
"It's in the statute somewhere" is not a privacy notice. People should see their rights—access, erasure, objection, complaint to a DPA—spelled out where they actually look. Pointing at the Official Journal is not the same as informing them.
Full Explanation
Articles 13 and 14 expressly require information about data-subject rights and the right to lodge a complaint with a supervisory authority. Controllers cannot rely on the mere existence of the GDPR text as a substitute for providing that information to individuals. The duty applies based on processing in scope, not only to non-EU establishments, and informing about rights does not waive Art. 6 requirements or depend on BCR approval.