An organization must inform individuals about the purposes for which it collects and uses information about them, how to contact the organization with any inquiries or complaints, the types of third parties to which it discloses the information, and the choices and means the organization offers individuals for limiting its use and disclosure. This notice must be provided in clear and conspicuous language when individuals are first asked to provide personal information to the organization or as soon thereafter as is practicable, but in any event before the organization uses such information for a purpose other than that for which it was originally collected or processed by the transferring organization or discloses it for the first time to a third party.
In observing the Notice Principle, organizations should take note of Article 4(3) FADP, which provides, “Personal data may only be processed for the purpose indicated at the time of collection, that is evident from the circumstances, or that is provided by law.”
It is not necessary to provide notice when disclosure is made to a third party that is acting as an agent to perform task(s) on behalf of and under the instructions of the organization (Art. 10a FADP). The Onward Transfer Principle, on the other hand, does apply to such disclosures.