2

True story. A bank erroneously sends its clients' data to a company: name, surname, national identification number. The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and is obliged to inform data subjects that they have obtained their data (Article 14 (2) b) and that they will want to destroy it, secure it or otherwise process it (Article 6 (1) letter f).

However, to inform the data subjects, the company would have to have their correspondence addresses. Because it has their national identification numbers, it can file a request to the appropriate national office, provide appropriate justification and obtain these addresses. Is it allowed, however?

Article 5 states:

Personal data shall be (...) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed

Article 11 states:

If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.

Improve this question
1
  • I guess "collecting personal data by mistake" is not lawful processing at all, according to article 6. This is a data breach for the bank, and the other company becomes a "controller" that only has one way to process the data lawfully: delete it.
    – reed
    Feb 27, 2019 at 22:25

2 Answers 2

Reset to default
2

(I'm hoping the bank has fulfilled its obligations to report to the supervisory authority under Article 33.)

The Regulation left the door open for confusion by listing "erasure or destruction" as "processing" under Article 4 paragraph 2. In terms of deletion (or not "maintaining"), article 11 paragraph 1 (as quoted in the question) is the relevant part of 2016/679.

Compliance with the Regulation would not be appropriate justification for obtaining additional information.

Improve this answer
3
  • 1
    I do not understand why you do not consider the recipient to be a third party. You quoted the definition and later showed that the recipient exactly fulfills it. Even so, you claim that it is not fulfilled. Can you explain this in other words?
    – Grzegorz Adam Kowalski
    Feb 26, 2019 at 14:10
  • 2
    I think you have misunderstood what the quoted piece is saying. "'third party means any [person] ... other than ... persons who, under the direct authority of the controller or processor, are authorised to process personal data". Precisely because the company is not under the direct authority of the bank they are a third party.
    – Martin Bonner supports Monica
    Feb 26, 2019 at 16:18
  • @GrzegorzAdamKowalski You're both right - I misread the "and" in '[everyone] and [those people]' - too keen to find something additional to justify the idea you didn't have a problem if you deleted the data. Your reference to Article 11 covers it. Editing.
    – ItWasLikeThatWhenIGotHere
    Feb 27, 2019 at 8:57
1

The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and is obliged to inform data subjects that they have obtained their data (Article 14 (2) b)

Article 4 has no standalone meaning. Just because a definition matches, nothing happens just because of that. The definitions in Article 4 have only a meaning when they are used somewhere else in the GDPR. I found 3 places:

  • Article 6 (Lawfulness of processing)
  • Article 13 (Information to be provided where personal data are collected from the data subject)
  • Article 14 (Information to be provided where personal data have not been obtained from the data subject)

All 3 are cases about "legitimate interests pursued by (...) a third party". This does not match the situation you describe, so the company is not a third party as defined in the GDPR.

But even if the company was a third party, the GDPR does not have any obligations for a third party. In particular article 14 has only obligations to a controller. It contains text like "the controller shall provide".

But that does not mean that the company has no obligations. It has obligations for a different reason.

The GDPR does apply to every processing of personal data. It is possible that processing is performed by different controllers. For example:

  • The German company Siemens writes on its website that Joe Kaeser is its CEO. So Joe Kaeser is the data subject, Siemens is the controller.
  • The googlebot reads the siemens website, add data about Joe Kaeser to its index, and allows other to search for that. This is still the same data, but now google is the controller.
  • I have searched using google and found that information about Joe Kaeser. I store that information in a document on my computer. If the GDPR would apply, I would be the controller. However, as I am a natural person and process the data in the course of a purely personal or household activity, the GDPR does not apply to this data processing.

In your example the company becomes the controller at the moment it obtains the data.

But article 14 would not apply in this case, because of Art. 14(5)(b) GDPR:

  1. Paragraphs 1 to 4 shall not apply where and insofar as:

    (b) the provision of such information proves impossible or would involve a disproportionate effort, (...) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing.

Article 11 does not apply, because it starts with a condition which is not met in this case:

If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, (...)

You also ask:

Because it has their national identification numbers, it can file a request to the appropriate national office, provide appropriate justification and obtain these addresses. Is it allowed, however?

Different countries may differently implement Article 87, but for example in the country I live, processing of the national identification number is only allowed when it is explicitly written in a law. So filing that request would be strictly forbidden just because of that.

Improve this answer
2
  • You wrote that Article 14 has only obligations to a controller. But why there is a mention of "third party" in Article 14(2)(b)? It looks like an obligation to a third party to disclose its legitimate interests.
    – Grzegorz Adam Kowalski
    Feb 27, 2019 at 22:03
  • 1
    the controller shall provide the data subject with the following information (...) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;. So if the controller bases processing of personal data on Art. 6(1)(f), the controller must explain what the legitimate interests are. For example google processes personal data because I have an interest searching in the data. That makes me the third party. Google must explain to the data subject that there are users like me who want to quickly search the internet.
    – wimh
    Feb 27, 2019 at 22:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .