2

The situation is following: I had an account in company A which then was sold to company B, both conduct online services. I wasn't aware of this because I didn't log in to my account for several years, after the login I saw following warning in my mailbox:

To log in to A, connect to an B account.

We recently sent you an email asking you to confirm which email address you’d like to use with A.

Since no email was confirmed, XXXXXX@YYYYYY.com was chosen, and your account was migrated to B account. All other email addresses on your account were removed.

Connect accounts

Upon communication with the support agent of company B, I realized that there is no process to opt-out and I cannot delete my account without connecting (migrating) to B. Even if I disagree with this acquisition and don't want my account to be migrated, i.e. I did not give my consent for such migration.

The company insists that it is GDPR compliant and it obeys all GDPR procedures. Is this true?

How does the above behaviour correlate with:

Under the article 21 I have the right to object any actions to my data which is based on point of Art 16, i.e. which are unlawful. Transferring (reselling) my personal data to another controller is not lawful in my opinion. Is my assumption correct?

Don't they violate GDPR by such actions?

P.S. The company B is international company originally from AU, and it explicitly states that it is GDPR compliant on the dedicated page on its website.

The company A was from US and had no mention of GDPR in privacy policy before acquisition (Jan 2017), so we assume it was not GDPR-compliant.

Pre-acquisition Terms of Use of A: https://pastebin.com/zXmCdLVQ
Pre-acquisition Privacy Policy of A: https://pastebin.com/T2EyX7Fb

6
  • You might want to read / link to the original privacy policy you agreed to when you signed up with A. They often include clauses which govern this situation.
    – Philipp
    Jun 30 at 12:01
  • do you have access to emails from the time when this acquisition happened? they theoretically should have sent you emails (or whatever your method of communication was) warning you of this change
    – Cassie
    Jun 30 at 12:11
  • 1
    They often include clauses which govern this situation here is the Terms of Service that were active in 2015-2018, before the acquisition pastebin.com/zXmCdLVQ. I don't see any explicit passage that allows reselling data. And here is the legacy privacy policy active 2018-2019 pastebin.com/T2EyX7Fb. the acquisition happened in 2017, but I didn't find any older version before 2018, probably in some or in most parts it left the same as before 2018
    – Suncatcher
    Jun 30 at 12:37
  • 1
    I doubt that selling the company - which includes selling the complete chain of custody for your data - is the same as selling your personal data as per the title of the question (that would make selling a company basically impossible). But of course they might have committed any other number of violations (such as not offering opt-outs or account deletion, or using your data for previously unconsented purposes) independently from that. Jun 30 at 13:17
  • yeah i agree. selling a business is probably not the same as selling data. it's transfer of data. this might be helpful: getterms.io/blog/… Jun 30 at 15:00

2 Answers 2

3

There is a lot going on in this question, so I'll pick out some individual aspects. Last but not least, I'll discuss if GDPR even applies.

Does the GDPR require consent for X?

Almost always, no. Consent is only one of many legal bases of processing. A common alternative to consent is a “legitimate interest” where a balancing test is performed between this legitimate interest and your interests, rights, and freedoms. Consent is typically only appropriate if this balancing test fails, for example if you would not reasonably expect this processing activity to occur.

It's worth noting that it's a reasonably common occurrence that businesses are sold or merged. This is not unexpected. In general, you would not be required to consent to such a transfer.

What can a company do with personal data acquired through a merger/acquisition?

The GDPR does not provide explicit provisions for this case. But it might be useful to think about the two cases where (a) the new company is a continuation or successor of the original one, and (b) where the data is transferred (“sold”) to an otherwise unrelated company.

In case (a) where the business is continued as normal, there is no change.

In case (b) where data is transferred to a separate company, things are more complicated.

  • The original company would need a legal basis for transferring the data. But as mentioned above, there might be a legitimate interest. Arguably, such a transfer could also be based on Art 6(1)(b) if the transfer is necessary to continue to provide the service, for example if the original company would otherwise have to terminate service.

    Of course, activities like data brokering where access to data is granted to unrelated third parties would generally fail to be covered by contractual necessity or a legitimate interest, and would probably need consent – but that doesn't seem to be the case here.

  • When a data controller (such as the new company) acquires your personal data from sources other than directly from you, then they are subject to the notice requirements in Art 14. They have to actively notify you about their processing activities. But because you received emails that mentioned the transfer, this condition might have been met.

    Of course the new company continues to be bound by the purpose limitation principle as detailed in Art 6(4) – they can only use the data for purposes that are compatible with the purposes for which the data was initially collected. Thus, the new company cannot arbitrarily widen processing purposes, though some change in scope is certainly permissible.

How does the GDPR right to object and to restrict processing apply here?

The Art 21 GDPR right to object means that if the legal basis for a processing activity is a “legitimate interest”, then you can ask for an opt-out. But in some cases, this objection does not have to be granted. An objection essentially requires the controller to repeat the legitimate interest balancing test, taking into account the “grounds relating to [your] particular situation” that you provided in the objection.

The Art 18 GDPR right to restrict processing is an alternative to the right to erasure. It applies only in narrow circumstances, for example while an objection is being checked.

It is likely that you were informed about the transfer to a new company about 1 month in advance, so that you would have been able to prevent this transfer by closing your account prior to the deadline. If the new company conducts processing activities based on a legitimate interest, then their presumably GDPR-compliant privacy notice about which you were notified will certainly explain that you have a right to object.

Is the new company GDPR-compliant?

That is impossible to tell, but nothing you've shown so far indicates that they're non-compliant.

My largest issue with this story is that the new company is from Australia, a country with extraordinarily bad privacy protections (as of 2022). However, due to the way how the GDPR treats international transfers of data, this doesn't prevent Australian data controllers from being GDPR-compliant, although it does make it difficult for other companies to use services based in Australia.

Does GDPR even apply?

Whether GDPR applies to a non-European company depends only on whether they either offer goods or services to people who are in Europe (“targeting criterion”), and whether the monitor people's behavior that takes place in Europe. Factors such as your citizenship would be irrelevant.

I'll ignore the monitoring criterion, and focus on the targeting criterion. I'll assume that you are in Europe (EU/EEA or UK).

Whether a company is targeting people in Europe depends primarily on the company's intentions. It does not matter whether the service is accessible from Europe.

Thus, it is quite possible that the original company was not subject to the GDPR. Then, any questions about GDPR, consent, and data transfers are moot.

In contrast, the new company clearly mentions GDPR-compliance, which would only matter if they intend for people in Europe to use their services. So GDPR probably applies to them, giving you the full suite of GDPR data subject rights as (hopefully) outlined in their privacy notice. And as long as they notified you that they acquired your personal data in accordance of Art 14, I don't seen anything that they might have done wrong in respect to this acquisition/merger.

2
  • great explanation, thanks. Then, any questions about GDPR, consent, and data transfers are moot. so if the original company was non-GDPR, so for me it is even illegitimate to ask those questions and demand smth from them? In my view the new owner should fullfill the GDPR rules anyway, incl. data protection and integrity
    – Suncatcher
    Jul 1 at 10:26
  • 1
    @Suncatcher Questions about consent etc with respect to the original company would be moot. You can of course still ask, but you might not be owed a satisfactory response. The new company is probably subject to the GDPR, giving you the full suite of GDPR data subject rights, but they might not be responsible for things that happened before the transfer.
    – amon
    Jul 1 at 10:58
0

GDPR allows you to query what data a company holds on you, and to request deletion if there is no legal justification to retain that data. You should not be required to log into any account to make that request.

1
  • 3
    in fact you are not even required to HAVE an account to demand that deletion
    – Trish
    Jun 30 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.