How does GDPR Art. 14 apply to large scale B2B data transfer

Question

Article 14 of the GDPR appears to require any data controller to inform the data subject when a business to business transfer of personal data occurs. Business to business transfer of personal data is a common occurrence, but I have never been informed of such a transfer in a way that seems to conform to this article. Am I interpreting this wrong, or are many large organisations breaching this law?

Art. 14 GDPR

Information to be provided where personal data have not been obtained from the data subject

1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

   • A load of metadata about the PII

2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:

   • Another load of metadata about the PII

3. The controller shall provide the information referred to in paragraphs 1 and 2:

   • Within a month, when they contact the data subject or when they share with a third party, whichever is earlier.

4. If you are going to do something new, tell the data subject

5. Paragraphs 1 to 4 shall not apply where and insofar as:

   • the data subject already has the information;
   • the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;
   • obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or
   • where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.

There are multiple organisations in the UK that take data from entities other than the data subject and pass data to third parties using an API where the data is returned within milliseconds of the request being made. These organisations include the credit reference agencies, the DVLA either directly or via MyLicence and the Credit Industry Fraud Avoidance System.

All these organisations collect personal data about indaviduals from entities other than the indaviual, process that data and share the results with third parties via a REST API that returns the PII immediately the request is made. From my reading of article 14 of the GDPR that they should inform me that they are holding this data within a month of collecting it, and at the latest at the point that the API response is sent, unless one of the situations in point 5 apply. I have never had such a communication from any of these entities.

With regards these situations in point 5 it is not obvious which could be relevant. All of these are about the individual, so not archiving, research or statistical purposes (b). I guess there is no obligation of professional secrecy (d). There may be explicit legal requirements for some of this processing, but I am not aware of any "expressly laid down by Union or Member State law" that would cover all this (c). (a) is slightly harder to interpret, as it is not clear exactly what information is being referred to. If it is the originally captured PII then this whole article would almost never apply as the data subject usually has access to their own data. If it means the list of metadata in sections 1 and 2 this exception would almost never apply, as for example the data subject will never know the period for which the personal data will be stored.

Am I reading it wrong, are these large organisation is obvious breach of the GDPR or is there another source of confusion?

For an example of when this happened to me, I got a parking ticket based on a ANPR camera. I made a subject access request, and I got a web service request and response, formated as XML. The request had my number plate and no information about the legal basis for processing, the response had my name and address (which I provided), the vehicle details (which came from a third party, the manufacturer I guess) and a load of codes that no one explained. It would seem that these transfers of PII would make both the DVLA and the parking firm data controllers engaged in transfer of PII derived from sources other than the data subject, and therefore both separately responsible for informing me of the details of the transfer. Specifically, passing the make, model and colour of the car (provided by a third party) to the parking control would bring section 3. (c) into play and I should be told "at the latest when the personal data are first disclosed", ie. when the web service returned. However I was not aware of it until I made the SAR.

Answer 1

Art 14 GDPR applies to the recipient of such B2B data sharing, not to the entity sharing the data. The sharing entity instead needs a legal basis for sharing the data, but that should already have been disclosed in their privacy notice per Art 13 when they acquired the data directly from the data subject.

Not all recipients of B2B personal data sharing are required to provide information per Art 14. In particular, if the recipient acts as a data processor, then the data controller needs to disclose this recipient per Art 13(1)(e), but the data processor doesn't have to – and shouldn't – disclose anything. A data processor is contractually bound to only use the data as instructed by the controller, but not for their own purposes.

If both parties are data controllers, then the recipient is responsible for their own compliance. They cannot just passively gobble up data, they need a legal basis for processing the data.

In the examples you've mentioned (credit rating, insurance quotes), the recipient actively pulls the data from another data controller. The recipient does this for the purpose of entering into a contract with the data subject. Since a direct relationship between recipient and data subject exists, there is ample opportunity for providing Art 14 information.

The data subject should be made aware that this information is available, but it's not generally necessary to actively push these documents onto the data subject. After all, a privacy notice generally only contains details about which data is necessary for what purpose and what rights are available. It cannot contain hidden clauses such as “by continuing to use our services, you consent to XYZ…”.

You are also concerned about data-broker like intermediaries that receive data from entity A and make it available to entity B:

+---+      +--------+      +---+
| A | ---> | broker | ---> | B |
+---+      +--------+      +---+

For example, credit rating agencies are an example of an entity acting in this broker position.

In practice, I agree that this is intransparent and possibly non-compliant. But in principle, this overlooks the data subject's relationship with entities A and B:

+---+      +--------+      +---+
| A | ---> | broker | ---> | B |
+---+      +--------+      +---+
  ^                          ^
  |     +--------------+     |
  +---> | data subject | <---+
        +--------------+

• A and the data subject enter into a contract. As a condition for entering into a contract, A asks for the data subject's consent* for sharing relevant data with the broker. A's privacy notice discloses the recipients of this data per Art 13(1)(e) GDPR, and explains to the data subject where the broker's privacy notice can be found.
• The broker receives the data. To fulfill the Art 14 requirements, a privacy notice is published on its website. The broker has a contract with A to ensure that data subjects are correctly notified about the broker's processing. The broker's privacy notice discloses how the information is shared with other parties, as required per Art 14(1)(e).
• B and the data subject enter into a contract. As a condition for entering into a contract, B asks for the data subject's consent* for requesting relevant data from the broker. B's privacy notice discloses the sources of this information per Art 14(2)(f). This provides the data subject with another opportunity for reading the broker's privacy notice, if they are so inclined (most are not).

* Consent might not always be necessary, in particular if the sharing/requesting of data is strictly necessary for performing the contract, or if there is a sufficient legitimate interest.