Article 14 or the obligation to inform people

When a company collects your data directly, it informs you at the time of collection: this is article 13 of the GDPR. When it obtains your data from a third party — a partner, a public source, an aggregator — Article 14 applies. For any player building a professional data index, this article is not a compliance detail: it is the most discriminating seriousness test in the sector.

What Article 14 requires

Article 14 requires providing the persons concerned, even if we have never met them, with complete information:

• the identity and contact details of the data controller;
• the purposes and legal basis — for example the legitimate interest of Article 6.1.f, which must then be explained;
• the categories of data processed;
• the source of the data, including when it comes from publicly accessible sources (article 14.2.f);
• the recipients or categories of recipients;
• shelf life;
• human rights, including the right to object under section 21.

The mention of the source is the point that many actors prefer to avoid. However, it is explicit in the text, and it is this which makes the data chain auditable.

The deadline: one month, not “when practical”

Article 14.3 sets three deadlines, and the earliest one applies:

• within a reasonable time after obtaining the data, at the latest one month ;
• at the latest during the first communication with the person, if the data is used to contact them;
• at the latest upon first disclosure to another recipient, if it is intended to transmit the data.

For an index that delivers data to clients, this third case is structuring: the information must precede the first delivery, not follow it.

The exceptions of article 14.5: framed, not extensible

Article 14.5.b provides an exception when the information proves impossible or would require disproportionate effort. It is the most invoked exception in the sector, and the most often incorrectly invoked.

Three points circumscribe it. First, disproportion is demonstrated, it cannot be decreed: it is necessary to document why individual information is materially out of reach, and this demonstration is considerably weakened once one has a valid professional email address. Then, the exception does not remove the obligation: it imposes appropriate alternative measures, including making the information publicly available. Finally, European supervisory authorities have already sanctioned data brokers who sheltered behind this exception without meeting the conditions. Taking advantage of it for convenience is a strategy with a limited duration.

How a serious index is organized

Article 14 is not inapplicable at the scale of an index; it requires engineering.

• An individual notification is sent when the index has a professional point of contact, with complete information and an opposition link in one click — within one month of ingestion and before any delivery to a customer.
• A register of notifications trace of who was informed, when, and on what version of the information policy: without a register, no proof, and without proof, no enforceable compliance.
• The information is retriggered in the event of subsequent processing for another purpose (article 14.4): we do not silently recycle data for another use.
• Public policy describes the categories of sources and partners, to neatly cover residual cases where individual reporting is actually impossible.

On the scale of an index of approximately 123,000 profiles, this system is an automated flow, not a heroic project. This is also the best indicator of good faith: an actor who automates its data deliveries but claims not to be able to automate people's information is supporting a difficult position.

Information as foundation, not friction

A professional data index lives or dies by its legitimacy. Article 14 is the piece that connects everything else: without information, the legal basis of article 6.1.f falters, and the right to object in article 21 remains theoretical since people are unaware of the existence of the processing. This is why, at sourcing.sh, notification is part of the ingestion pipeline in the same way as deduplication: data is only considered deliverable once the information obligation has been processed. It is not a supplement of soul, it is a condition of functioning.