The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and is obliged to inform data subjects that they have obtained their data (Article 14 (2) b)
Article 4 has no standalone meaning. Just because a definition matches, nothing happens just because of that. The definitions in Article 4 have only a meaning when they are used somewhere else in the GDPR. I found 3 places:
- Article 6 (Lawfulness of processing)
- Article 13 (Information to be provided where personal data are collected from the data subject)
- Article 14 (Information to be provided where personal data have not been obtained from the data subject)
All 3 are cases about "legitimate interests pursued by (...) a third party". This does not match the situation you describe, so the company is not a third party as defined in the GDPR.
But even if the company was a third party, the GDPR does not have any obligations for a third party. In particular article 14 has only obligations to a controller. It contains text like "the controller shall provide".
But that does not mean that the company has no obligations. It has obligations for a different reason.
The GDPR does apply to every processing of personal data. It is possible that processing is performed by different controllers. For example:
- The German company Siemens writes on its website that Joe Kaeser is its CEO. So Joe Kaeser is the data subject, Siemens is the controller.
- The googlebot reads the siemens website, add data about Joe Kaeser to its index, and allows other to search for that. This is still the same data, but now google is the controller.
- I have searched using google and found that information about Joe Kaeser. I store that information in a document on my computer. If the GDPR would apply, I would be the controller. However, as I am a natural person and process the data in the course of a purely personal or household activity, the GDPR does not apply to this data processing.
In your example the company becomes the controller at the moment it obtains the data.
But article 14 would not apply in this case, because of Art. 14(5)(b) GDPR:
Paragraphs 1 to 4 shall not apply where and insofar as:
(b) the provision of such information proves impossible or would involve a disproportionate effort, (...) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing.
Article 11 does not apply, because it starts with a condition which is not met in this case:
If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, (...)
You also ask:
Because it has their national identification numbers, it can file a request to the appropriate national office, provide appropriate justification and obtain these addresses. Is it allowed, however?
Different countries may differently implement Article 87, but for example in the country I live, processing of the national identification number is only allowed when it is explicitly written in a law. So filing that request would be strictly forbidden just because of that.