After the principle of lawfulness, which has been discussed in the previous article, the General Data Protection Regulation also introduces the principle of fairness. This term is better explained if linked with the notions of honesty and good faith that the controller has to follow at all stages of the processing of personal data. In fact, all the operators who take part in the processing activities, shall work within the ethical dimension of fairness.

Another crucial principle stated in the GDPR is the principle of transparency. Compliance with this principle ensures that the data subject has full knowledge of the person who processes their data and the way in which the data are processed. A notice shall be given to data subjects by the controller, as a tool that enables them to know what to expect from the processing of their personal data.

The issue of transparency is discussed in much greater detail in the Data Protection Regulation, than in the 95/43/CEE Directive. The underlying logic is to give to the data subject the means to reach full awareness of the use that will be made of their data. For this reason, too, the notice may be differentiated depending on the type of data subjects addressed.

The Regulation also lays down (as the Directive had previously done), that any data processing shall observe the principle of purpose limitation. Firstly, the purposes of the processing must be precisely and fully identified prior to, or at the moment of the collection. Then, the purposes must be made explicit and communicated to the data subject, who has to know the reasons why their data are collected and processed. Data collected for a specific purpose may be further processed for different purposes, provided that these are not incompatible with the initial purposes.

A very useful tool to assess compatibility is the Opinion 03/2013 on purpose limitation, issued by the WP29: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2013/wp203_en.pdf

These principles aim to make explicit and clear to data subjects what are the purposes and the modalities of the processing, so that they can make informed, free choices with regard to the usage of their data. As a result, there is no room for loopholes, unclear information, or implicit consequences that may harm the data subject.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.