If a privacy agreement on a web service states that it will not disclose your personal information to any outside party, can the information be disclosed to a third party under an NDA? The NDA would be solely for the purpose of evaluating a potential business opportunity and would not allow disclosure or use of the information other than for the business opportunity evaluation.
2 Answers
You'd be in breach of contract
The privacy agreement with the Data Subject DS is a contract. Unless your contract has a specific notion that allows you to give DS' information to a third party, you'd breach that contract by giving the information to a third party.
The mere existence of the NDA with a third party about DS' information would be evidence of an intent to breach, no matter if the information ever was given to the third party.
Exceptions: Requirement under the law
In some cases, your privacy agreement might need to follow laws that require disclosure of information. Such cases would be for example a financial service's reporting obligations about possible money laundering or to follow a court order that demands providing the cellphone information of DS from a service provider.
A Privacy agreement ought to carve out those requirements or mandatory reporting cases from the general no-disclosure stance.
No
You say you won't disclose personal information, therefore, you can't disclose personal information.
Now, if your privacy policy said "We won't disclose your personal information except ..." then, so long as you did the "..." that would be fine (subject to privacy law).
