#privacypeeps

Question for ye: My typical pattern and practice when drafting a #privacy notice or statement is to provide a user-friendly definition of the various relevant bits (lawful basis, transfers, data subject rights, etc.) but to omit citations (so, I'd explain 'legitimate interest' as a basis, but not include Article 6(1)(f), or Right of Access w/o citing Article 15).

A client was curious if this was 'allowed' or if citations must be included.

In light of #Article12's obligations to provide notice in a ' concise, transparent, #intelligible and easily accessible form, using #clear and #plain language", along with recent decisions and the WP 29 guidance, I find citations to be too lawyerly for most, and to add to what are often already bloated policies.

What do you think? Am I missing guidance somewhere? Is it different by jurisdiction (client is based in Germany, and I profess, sometimes I miss guidance coming from the myriad DPAs).

#notice #GDPR #privacy #language #transparency #clarity