To clarify the title, here is an example:
- Alice wants to sign up to online store Nile.com
- Alice enters the email
- Nile.com does not send a verification that Alice has to complete but directly accepts the registration and the email
- Alice orders stuff from Nile.com
- Bob, who is completely unrelated to Alice, starts getting emails that contain information about Alice that includes her name, (delivery) address and purchases
I tried to look through the entire text but I honestly got lost around the processing sections. The only relevant part I noticed was in Chapter II, article 5
- Personal data shall be:
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
What are the legal obligations of Alice and Nile.com here? It is ultimately Alice who made the mistake and Nile are following the user's preference for contact, even if it's wrong. I couldn't see (or I missed) if Alice has an obligation to provide accurate data. At the same time it seems like Nile.com should have done due diligence before essentially leaking (is this considered "accidentally losing"?) PII to a third party.