In the first layer of a video monitoring privacy notice, can data subject rights be omitted in favour of providing the DPO's contact details?
ANSWER
As a rule, the first layer of the information obligation should include the controller's identity, the purpose, data subjects' rights and where the full privacy notice can be found. Such a notice may be supplemented with matters important to the data subject, especially if they might be unexpected. Because the information on rights required by Article 13 GDPR is quite lengthy, a common practice is to include in the first layer only a clear reference to where full information on rights related to processing can be found. Providing the DPO's contact details alone does not fulfil that function.
