Collection of personal data

The collection of personal data refers to obtaining information relating to an identified or identifiable natural person. It is a form of processing within the meaning of Article 4(2) of the General Data Protection Regulation (GDPR). Organisations may only collect personal data where an appropriate legal basis exists and the data protection principles are observed. The principles of purpose limitation and data minimisation, as well as the information obligations towards data subjects, are particularly important in this regard.

What does the collection of personal data mean?

Collection is a processing operation within the meaning of Article 4(2) GDPR. It encompasses obtaining personal information, regardless of whether this is done manually or by automated means.

For example, data is collected when an organisation receives customer details as part of an order, receives job application documents or records information about how its website is used.

Automatically recorded IP addresses or location data may also be subject to data collection, provided that they can be linked to an identifiable individual.

Collection must be distinguished from other processing operations, such as storage, analysis, disclosure or erasure. The applicable data protection requirements must be complied with for each processing operation.

What is the difference between direct and indirect data collection?

Personal data may be collected directly from the data subject or obtained from other sources. This distinction is particularly relevant to the information obligations under the GDPR.

Direct data collection

In the case of direct data collection, the controller obtains personal data directly from the data subject.

This is the case, for example, when a customer enters their contact details when placing an order online or an applicant submits their application documents to an organisation.

In these cases, the information obligations under Article 13 GDPR generally apply. The required information must be provided to the data subject at the time the personal data is obtained, unless they already have that information.

Indirect data collection

In the case of indirect data collection, the controller does not obtain personal data directly from the data subject but, for example, from a business partner or a public register.

In these cases, the information obligations under Article 14 GDPR generally apply. Specific rules govern when the information must be provided, as well as certain statutory exceptions.

The fact that personal data is publicly accessible does not mean that it may be collected and processed for any purpose without an appropriate legal basis.

Under what conditions is the collection of personal data permitted?

The collection of personal data is lawful only if at least one appropriate legal basis under Article 6(1) GDPR applies.

Depending on the processing activity, the following legal bases may be relevant in particular:

• Consent: The data subject has validly consented to the processing of their personal data under Article 6(1)(a) GDPR.
• Performance of a contract: Under Article 6(1)(b) GDPR, collection is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation: Under Article 6(1)(c) GDPR, processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests: Under Article 6(1)(f) GDPR, collection is necessary for the purposes of legitimate interests pursued by the controller or a third party, provided that those interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

Article 6(1) GDPR also provides for other legal bases, such as protecting the vital interests of an individual or carrying out certain tasks in the public interest.

Consent is therefore not required for every instance of data collection. What matters is the legal basis applicable to the specific purpose of processing.

In addition, organisations must observe the principles set out in Article 5 GDPR:

• Purpose limitation: Personal data must be collected for specified, explicit and legitimate purposes.
• Data minimisation: The data collected must be adequate, relevant and limited to what is necessary for the purposes for which it is processed.
• Transparency: Data subjects must be able to understand how and for what purposes their personal data is processed.
• Lawfulness and fairness: Data collection must be based on a lawful ground and must take account of the rights of data subjects.

Additional requirements apply to special categories of personal data, such as health data, under Article 9 GDPR.

What information obligations apply when collecting personal data?

Controllers generally have an obligation to inform data subjects about the processing of their personal data. The information that must be provided and the timing depend, in particular, on the source from which the data was obtained.

Information obligations under Article 13 GDPR

Where personal data is collected directly from the data subject, the required information must generally be provided at the time the data is obtained.

This includes, in particular:

• the name and contact details of the controller;
• where applicable, the contact details of the data protection officer;
• the purposes and legal bases for the processing;
• where applicable, the legitimate interests pursued by the controller or a third party;
• where applicable, the recipients or categories of recipients;
• where applicable, information about transfers to third countries;
• the storage period or the criteria used to determine it;
• information about the rights of the data subject.

Depending on the processing activity, further information required by law may also need to be provided.

Information obligations under Article 14 GDPR

Where personal data is not collected directly from the data subject, the information obligations under Article 14 GDPR generally apply.

In addition, the controller must provide information in particular about the categories of personal data concerned and the source from which the data originates.

As a general rule, the information must be provided within a reasonable period and, at the latest, within one month after obtaining the data. If communication with the data subject is envisaged, the information must be provided no later than the time of the first communication. If disclosure to another recipient is intended, the information must generally be provided no later than the time of the first disclosure.

Article 14(5) GDPR provides for statutory exceptions. For example, it is not necessary to provide the information again where the data subject already has the relevant information. Further exceptions apply under certain conditions, including where providing the information proves impossible or would involve disproportionate effort.

Under Article 12 GDPR, information must be provided in a concise, transparent, intelligible and easily accessible form.

What practical obligations must organisations observe when collecting personal data?

In addition to checking the legal basis and meeting their information obligations, organisations must design their data collection processes in a way that complies with data protection requirements, both organisationally and technically.

The following measures are particularly relevant:

• Data protection by design: Under Article 25 GDPR, organisations must implement appropriate technical and organisational measures to incorporate data protection principles into the design of processing activities from the outset. Examples include privacy-friendly default settings in online forms.
• Secure collection procedures: Under Article 32 GDPR, personal data must be protected by appropriate technical and organisational measures. For online forms, this may include appropriate encryption of data transmissions.
• Documentation: Organisations must be able to demonstrate compliance with the data protection principles under Article 5(2) GDPR. Where the requirements of Article 30 GDPR are met, the processing must also be documented in a record of processing activities.
• Assessment of specific risks: If processing is likely to result in a high risk to the rights and freedoms of natural persons, a data protection impact assessment must be carried out in advance under Article 35 GDPR.

The specific measures required depend on the nature, scope, context and purposes of the processing, as well as the associated risks.

Unlawful data collection may result in supervisory measures under Article 58 GDPR and administrative fines under Article 83 GDPR.

Practical example: Collection of customer data when placing an online order

An online retailer collects a customer's name, delivery address, email address and the details required for payment processing when an order is placed.

The data is needed to process the order, dispatch the goods and fulfil the contractual obligations. The collection of the data required for these purposes may therefore be based on Article 6(1)(b) GDPR.

In addition, the online retailer would like to collect its customers' dates of birth in order to provide personalised birthday offers.

Since a date of birth is not necessary for the ordinary processing of an order, its collection cannot be justified solely on the basis of the performance of a contract. The retailer must identify a separate appropriate legal basis for this additional processing. Voluntary consent may be one possible option.

The online retailer informs its customers during the ordering process about the purposes of data collection, the relevant legal bases and the other information required under Article 13 GDPR.

legal data assessment: Organisations should assess which personal data is actually required when designing forms and digital ordering processes. Additional information may only be collected for specified purposes and on an appropriate legal basis.

Privacy-friendly design, secure collection procedures and transparent information help prevent data protection violations.

Legal bases

Article 4(2) GDPR; Articles 5 and 6 GDPR; Article 9 GDPR; Articles 12 to 14 GDPR; Articles 25 and 30 GDPR; Articles 32 and 35 GDPR; Articles 58 and 83 GDPR.