Alice has a business relationship with Bob, which involves both keeping contact information and enough physical interaction to count as a contact. Charlie contacts Alice and requests Bobs contact details without proving their identity. As I understand it to share this information would be a breach of article 5(1)(f) the GDPR in that Alice has not "ensure[d] appropriate security of the personal data", and would therefore be illegal.

If Charlie claims, but does not prove, to be working for the UK test and trace service does this change the situation? Note that it is reported that the test and trace contacts are protected only by "it'll be obvious you're talking to a professional".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.