Article 14 of the GDPR appears to require any data controller to inform the data subject when a business to business transfer of personal data occurs. Business to business transfer of personal data is a common occurrence, but I have never been informed of such a transfer in a way that seems to conform to this article. Am I interpreting this wrong, or are many large organisations breaching this law?
Art. 14 GDPR
Information to be provided where personal data have not been obtained from the data subject
Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:
- A load of metadata about the PII
In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:
- Another load of metadata about the PII
The controller shall provide the information referred to in paragraphs 1 and 2:
- Within a month, when they contact the data subject or when they share with a third party, whichever is earlier.
If you are going to do something new, tell the data subject
Paragraphs 1 to 4 shall not apply where and insofar as:
- the data subject already has the information;
- the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available;
- obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or
- where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.
There are multiple organisations in the UK that take data from entities other than the data subject and pass data to third parties using an API where the data is returned within milliseconds of the request being made. These organisations include the credit reference agencies, the DVLA either directly or via MyLicence and the Credit Industry Fraud Avoidance System.
All these organisations collect personal data about indaviduals from entities other than the indaviual, process that data and share the results with third parties via a REST API that returns the PII immediately the request is made. From my reading of article 14 of the GDPR that they should inform me that they are holding this data within a month of collecting it, and at the latest at the point that the API response is sent, unless one of the situations in point 5 apply. I have never had such a communication from any of these entities.
With regards these situations in point 5 it is not obvious which could be relevant. All of these are about the individual, so not archiving, research or statistical purposes (b). I guess there is no obligation of professional secrecy (d). There may be explicit legal requirements for some of this processing, but I am not aware of any "expressly laid down by Union or Member State law" that would cover all this (c). (a) is slightly harder to interpret, as it is not clear exactly what information is being referred to. If it is the originally captured PII then this whole article would almost never apply as the data subject usually has access to their own data. If it means the list of metadata in sections 1 and 2 this exception would almost never apply, as for example the data subject will never know the period for which the personal data will be stored.
Am I reading it wrong, are these large organisation is obvious breach of the GDPR or is there another source of confusion?
For an example of when this happened to me, I got a parking ticket based on a ANPR camera. I made a subject access request, and I got a web service request and response, formated as XML. The request had my number plate and no information about the legal basis for processing, the response had my name and address (which I provided), the vehicle details (which came from a third party, the manufacturer I guess) and a load of codes that no one explained. It would seem that these transfers of PII would make both the DVLA and the parking firm data controllers engaged in transfer of PII derived from sources other than the data subject, and therefore both separately responsible for informing me of the details of the transfer. Specifically, passing the make, model and colour of the car (provided by a third party) to the parking control would bring section 3. (c) into play and I should be told "at the latest when the personal data are first disclosed", ie. when the web service returned. However I was not aware of it until I made the SAR.