Fairness and transparency

Fairness and transparency are, together with lawfulness, the first principle of data protection in Art. 5(1)(a) GDPR: personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

Transparency is concretised in Art. 12 to 14: the controller must provide concise, intelligible, easily accessible information in clear and plain language about who is processing the data, why, on what legal basis, for how long, with whom it is shared, whether it leaves the EEA and what rights the individual has (see right of information and privacy notice). The EDPB Guidelines on transparency (WP260) stress layered notices and the need to inform individuals about processing they would not reasonably expect.

Fairness is less codified but no less enforceable. It requires that processing does not exploit, deceive or disadvantage individuals, that expectations set at collection are honoured, and that power imbalances (employer and employee, sponsor and patient) are not abused. The EDPB Guidelines 03/2022 on deceptive design patterns treat "dark patterns" in interfaces as breaches of fairness. In clinical research, fairness and transparency mean that informed consent forms and information notices describe all data recipients, including CROs, vendors and non-EU affiliates, and that re-use of data for purposes not disclosed at enrolment is either compatible under Art. 6(4) or subject to fresh information. These principles are also the anchor of the AI Act's transparency obligations for AI systems interacting with people.