Legal sending personal information to a third party if the user supplied incorrect contact information?

Question

To clarify the title, here is an example:

1. Alice wants to sign up to online store Nile.com
2. Alice enters the email [email protected] by accident
3. Nile.com does not send a verification that Alice has to complete but directly accepts the registration and the email
4. Alice orders stuff from Nile.com
5. Bob, who is completely unrelated to Alice, starts getting emails that contain information about Alice that includes her name, (delivery) address and purchases

I tried to look through the entire text but I honestly got lost around the processing sections. The only relevant part I noticed was in Chapter II, article 5

1. Personal data shall be:

[...]

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

[...]

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

(emphasis mine)

What are the legal obligations of Alice and Nile.com here? It is ultimately Alice who made the mistake and Nile are following the user's preference for contact, even if it's wrong. I couldn't see (or I missed) if Alice has an obligation to provide accurate data. At the same time it seems like Nile.com should have done due diligence before essentially leaking (is this considered "accidentally losing"?) PII to a third party.

Answer 1

The Company needs to ensure the identification of the person who provides the Personal Data as the Data Subject (as per Article 13) or, when the Data is known by the company to have been gathered from another source than the Data Subject to observe by Article 14 and inform the Data Subject while asking for his/ her Consent. So, in this case, the company is the one that breached GDPR by having not identified the person inputting the Data as the Data Subject... which can be easily accomplished with two-factor authentication (just as an example). Alice may have acted on purpose, yet that is not within the scope of GDPR in this case... it may be within the scope of civil prosecution by Bob... but that is too farfetched.