5

How does GDPR apply to companies getting someone else's personal data from a legitimate source?

For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a messaging app) can the company store personal information about the other person (e.g. their email address) obtained from me as a private, personal individual?

If so, do they need to notify the other individual, like as if it was obtained from a third party company?

Let's assume the app relied on obtaining the personal information from me under legitimate interests or consent, does it automatically follow that the personal information about the other person is on the same lawful basis or can it be a stronger one? Can they invoke the right to erasure or object, even if that will interfere with my usage as another customer?

I don't have an app: This question was inspired by the BBC GDPR quiz: http://www.bbc.co.uk/news/technology-44224802 Which has a question on the topic, but no detailed information.

Improve this question
2
  • Weird how little attention this question got. An address book can contain a lot of personal info: name, email, physical address, photo, date of birth, precisely the stuff a lot of people dont want to share with dodgy firms outside of EU jurisdiction.
    – Ivana
    Jan 7, 2020 at 15:09
  • Thanks, i've tried asking this a few times via various mechanisms and never got a satisfactory answer. I'm beginning to think no one knows.
    – David
    Jan 9, 2020 at 13:24

1 Answer 1

Reset to default
2

So, I got on chat and asked a support agent of the information commissioners office (UK). Posting the responses here in case anyone else wants to see.

If they obtain personal data from a source other than the data they will have to provide privacy information unless there is an extremely good reason not to. Their lawful basis might be the same as for you or it might be different. They clearly will not be able to rely on consent. The rights such as right to erasure and right to object will still be available if the criteria to comply with such a request are met

I asked them if it meant that, e.g. Whats app would need to contact people on others contact list, the answer was

It seems to me that that should happen but there are some possible exemptions to providing privacy data under Article 14.

When asked which exclusion would be relevant:

I am not saying any [exclusion] would apply in this case. I am saying those are the ones that exist and if a data controller chose not to provide the information they would have to identify one of the exemptions or explain another reason they had not done so.

If anyone has a further answer on what exclusion is most likely to apply I'd be happy to hear it!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .