(61) Information on the processing of personal data concerning the data subject must be provided to the data subject at the time of data collection, or, if the data is not obtained from the data subject but from another source, within a reasonable period of time, as the case may be. If the personal data can be lawfully disclosed to another recipient, the data subject must be informed at the time of the first disclosure to that recipient. If the controller plans to process personal data for a purpose other than the purpose for which the personal data was collected, the controller should inform the data subject of the other purpose and provide him with other necessary information before such further processing. If the data subject cannot be told the origin of the personal data because different sources were used, the information should be provided in general terms
„We are perfectly capable of assessing the risk ourselves."
Are you sure about that?

