How does GDPR apply to companies getting someone else's personal data from a legitimate source?
For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a messaging app) can the company store personal information about the other person (e.g. their email address) obtained from me as a private, personal individual?
If so, do they need to notify the other individual, like as if it was obtained from a third party company?
Let's assume the app relied on obtaining the personal information from me under legitimate interests or consent, does it automatically follow that the personal information about the other person is on the same lawful basis or can it be a stronger one? Can they invoke the right to erasure or object, even if that will interfere with my usage as another customer?
I don't have an app: This question was inspired by the BBC GDPR quiz: http://www.bbc.co.uk/news/technology-44224802 Which has a question on the topic, but no detailed information.