Assume we have two separate lists of emails handled by two different processors. List A is gathered by company A in a way that the subject has given their consent for its processing for marketing purposes. List B is gathered by company B in a way that the user gives no specific consent for any marketing use.

If company A sends emails to company B, and company B responds with "yes, this exists in our database" or "no, this does not exist in our database" - does that require company B to gather consent from the subject?

I have been unable to find any information relating to this scenario in terms of what GDPR requires. I suspect it requires company B to get consent from its subjects, but I cannot find any specific support for this in GDPR.

EDIT: As people have pointed out in the comments, companies A and B are controllers here and not processors; excuse me for my misuse of the terminology.

  • 1
    Can you explain why you assume company A and B are both processors? It looks to me that both are controllers based on your description. – wimh Apr 17 at 16:54

If companies A, B are processors in the sense of the GDPR, the processors cannot decide whether to collect consent. This is the obligation of the data controller. Any processing by a data processor happens under the authority of the controller. This also means that it doesn't necessarily make sense to protect the data stored at company B with a “this does/doesn't exist” response.

It is the controller's job to determine the purpose of processing – why are they querying the B email list? Then, the controller must find a legal basis for this processing. Consent is only one legal basis among many. Consent is only explicitly required for a few narrow cases, however certain use cases effectively require consent as well, such as email marketing without a prior business relationship.

By itself the queries to B's list are not an actual purpose of processing so it depends on why these queries will be done.

For example, if membership in B's list is used to infer interests for marketing purposes that would be a purpose that would make it possible to discuss whether consent would be required. My hunch is that for that specific example, an argument could be made for legitimate interest instead. But the processing might be considered to be profiling, in which case additional restrictions might apply (e.g. some kinds of profiling do require consent).

If personal data was collected for one purpose but shall be used for another, Article 6(4) requires the controller to perform an analysis to determine whether this repurposing is possible: just because you have the data does not mean you can use it towards your goals. In particular, repurposing is not allowed if the legal basis for collecting the data was consent. In contrast, it may be allowed if the legal basis was legitimate interest.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.