Under Art. 32 I the following informing requirements are not applicable:
- The appointment of the data protection officer in the event of compulsory appointment
- The specification of the legal basis for the processing operation
- The specification of an adequacy decision or sufficient guarantees in the event of a transfer to a third country
Art. 32 II stipulates that every user of an electronic communication process must be informed of the reading or writing of information from/to a terminal device and of his/her right to object and that the former may only be carried out with his/her consent.
- Under Art. 32 III al. 2, no informing obligations must be fulfilled if the data is subsequently processed for purposes under Art. 89 GDPR (archive purposes, scientific or historical research purposes and statistical purposes).
- 32 IV provides that if personal data collected is made anonymous within a short period of time by a procedure previously authorized by the CNIL, it is only necessary to provide information on the identity of the controller and the purpose of the processing.
- Art. 32 V provides that in the case of processing of personal data by public authorities in connection with state security, state defence or public security, no information obligations are to be fulfilled vis-à-vis the data subjects if the restriction of informing rights is justified by the purposes of the processing.
