Does GDPR require consent for a processor to confirm or deny the existence of data?

Question

Assume we have two separate lists of emails handled by two different processors. List A is gathered by company A in a way that the subject has given their consent for its processing for marketing purposes. List B is gathered by company B in a way that the user gives no specific consent for any marketing use.

If company A sends emails to company B, and company B responds with "yes, this exists in our database" or "no, this does not exist in our database" - does that require company B to gather consent from the subject?

I have been unable to find any information relating to this scenario in terms of what GDPR requires. I suspect it requires company B to get consent from its subjects, but I cannot find any specific support for this in GDPR.

EDIT: As people have pointed out in the comments, companies A and B are controllers here and not processors; excuse me for my misuse of the terminology.

Answer 1

If companies A, B are processors in the sense of the GDPR, the processors cannot decide whether to collect consent. This is the obligation of the data controller. Any processing by a data processor happens under the authority of the controller. This also means that it doesn't necessarily make sense to protect the data stored at company B with a “this does/doesn't exist” response.

It is the controller's job to determine the purpose of processing – why are they querying the B email list? Then, the controller must find a legal basis for this processing. Consent is only one legal basis among many. Consent is only explicitly required for a few narrow cases, however certain use cases effectively require consent as well, such as email marketing without a prior business relationship.

By itself the queries to B's list are not an actual purpose of processing so it depends on why these queries will be done.

For example, if membership in B's list is used to infer interests for marketing purposes that would be a purpose that would make it possible to discuss whether consent would be required. My hunch is that for that specific example, an argument could be made for legitimate interest instead. But the processing might be considered to be profiling, in which case additional restrictions might apply (e.g. some kinds of profiling do require consent).

If personal data was collected for one purpose but shall be used for another, Article 6(4) requires the controller to perform an analysis to determine whether this repurposing is possible: just because you have the data does not mean you can use it towards your goals. In particular, repurposing is not allowed if the legal basis for collecting the data was consent. In contrast, it may be allowed if the legal basis was legitimate interest.