When personal data is collected from sources other than the individual, including publicly available sources, the organization must ensure transparency, fairness, and lawful processing and disclosure.

• Inform the data subject within a reasonable time after collection, including the categories and sources of data.
• Ensure the processing or disclosure serves a specific, lawful purpose and is limited to the minimum data necessary.
• Take appropriate measures to protect the privacy and rights of all individuals.
• Confirm that any disclosure of publicly available data complies with applicable laws and does not breach data protection requirements.
• Notification is not required if the individual already has the information, disclosure is impractical or excessive, or processing occurs under legal, confidentiality, or public interest obligations.

The above conditions do not apply if the data subject already has the information, disclosure is impossible or disproportionate, the data is collected under legal or confidentiality obligations, or processed by a public authority for security, judicial, or public interest purposes.

Tietovarannon tiedot ovat lähtökohtaisesti vain kyseisen rekisterinpitäjän käytössä ja samalla vastuulla. Mikäli luovutat tietoja eteenpäin toiselle organisaatiolle muuta käyttöä varten, siitä on informoitava selkeästi ja kerrottava mm. luovutuksen vastaanottaja sekä peruste.