Article 13 of the GDPR specifies the information a controller must provide when collecting personal data directly from a data subject. This list does not include "the categories of personal data concerned." The rationale is that the data subject is actively providing the data and is therefore inherently aware of the categories of data being collected. This requirement, however, is explicitly listed under Article 14(1)(d) of the GDPR, which applies when personal data is obtained from a source other than the data subject.

A. The recipients or categories of recipients. This is incorrect. Article 13(1)(e) of the GDPR explicitly requires the controller to provide information on the recipients or categories of recipients of the personal data.
C. The rights of access, erasure, restriction, and portability. This is incorrect. Article 13(2)(b) mandates that the data subject be informed of their rights, including the right to request access, rectification, erasure, restriction, and data portability.
D. The right to lodge a complaint with a supervisory authority. This is incorrect. Article 13(2)(d) of the GDPR clearly states that the data subject must be informed of their right to lodge a complaint with a supervisory authority.

1. Regulation (EU) 2016/679 (General Data Protection Regulation).

Article 13 ('Information to be provided where personal data are collected from the data subject'): This article lists all required information. It includes recipients (13(1)(e)), data subject rights (13(2)(b)), and the right to complain (13(2)(d)), but does not mention "categories of personal data concerned."

Article 14 ('Information to be provided where personal data have not been obtained from the data subject'): This article, in contrast, explicitly requires providing "the categories of personal data concerned" under Article 14(1)(d).

2. Article 29 Working Party, 'Guidelines on Transparency under Regulation 2016/679' (WP260 rev.01), adopted on 11 April 2018.

Page 21, Table: The document provides a comparative table of the information requirements for Articles 13 and 14. It clearly indicates that "The categories of personal data concerned" is a requirement under Article 14 only, not Article 13.

3. Bygrave, L. A. (2020). Data Privacy Law: An International Perspective. Oxford University Press.

Chapter 7, Section 7.4.2 ('Duty to provide information'): This section discusses the transparency obligations under the GDPR, distinguishing between the information requirements for direct collection (Article 13) and indirect collection (Article 14), noting that the categories of data are only required for the latter.