The classic trap
Recital 62 opens four exceptions to the information obligation under Articles 13 and 14 GDPR: data subject already possesses the information, recording expressly laid down by law, impossibility, and disproportionate effort. In practice, the CNPD and the CNIL sanction organisations that invoke disproportionate effort as a generic excuse for not informing scraped prospects, purchased B2B databases or migrated customer history. The EDPB reminds in its transparency guidelines (WP260 rev.01) that this exception must be interpreted strictly and requires a documented balancing test, not a declaration of principle.
The 3 criteria to document before invoking the exception
- Number of data subjects: informing 50 people is never disproportionate, informing 2 million historical contacts may be, depending on context.
- Age of the data: the older the data, the higher the re-contact cost and the lower the benefit for the data subject.
- Appropriate safeguards adopted: publication of a general notice on the website, collective information via press, pseudonymisation, access restriction, early deletion.
The trap: invoking the exception without tracing the balance. The CNPD expects a written, dated document signed by the DPO that demonstrates the reasoning for each database concerned. Failing that, the exception falls and the absence of information becomes a standalone Article 14 violation, sanctionable up to 20 million euros or 4% of global turnover.
How Luxgap automates this risk
Our Luxgap Exception Balance Engine turns the vague invocation of disproportionate effort into a defensible file opposable to the CNPD. The tool is an AI agent that automatically queries your CRM databases (Salesforce, HubSpot, Odoo, Dynamics), calculates in real time the three criteria of recital 62, and produces a cryptographically signed balancing memo, ready to present in case of audit.
- Automatically identifies each database containing indirectly collected data (file purchase, scraping, M&A, legacy migration) by scanning origins declared in the CRM and supplier contracts.
- Calculates for each database the ratio of information cost to benefit for the data subject, by crossing volume, average age, historical email bounce rate and unit postal cost.
- Automatically suggests adapted compensatory safeguards: enriched general notice, model press communication, deferred pseudonymisation, early purge, simplified objection right.
- Generates the timestamped Article 14(5)(b) balancing memo signed by the DPO, demonstrating the quantified reasoning for each database and constituting Article 5(2) accountability evidence.
- Alerts as soon as a database crosses the disproportion threshold (volume, age) or drops below it (re-information now feasible after migration to a new CRM).
- Automatically publishes the general /indirect-sources/ notice on your website, updated whenever a new database enters the exception perimeter.
Available alongside a Luxgap DPO mandate or as a dedicated SaaS module depending on your perimeter. Request a personalised quote and our teams will prepare a demonstration on your actual databases, with a free 48-hour blank audit to identify the Article 14(5) exceptions you invoke without knowing it.
