Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission.
Can I tell such details legally to my lawyer when referring to individuals related to a case without the data owner's approval?
I live in the European Union.
According to my knowledge I am not allowed to share other people's full name nor phone number nor email address without their permission.
That is not correct. According to GDPR Article 2:
This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
This Regulation does not apply to the processing of personal data ...
...
(c) by a natural person in the course of a purely personal or household activity;
GDPR Recital 18 states in relevant part:
(2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities.
Personal data that is not processed by "automated means", for example data which is transmitted verbally, by hand writing, or by manually sent email, is not covered by the GDPR. Data which is used by a natural person for "personal activities" is also not covered. Consulting one's personal lawyer might well be a personal activity unless it is a business matter.
Even if such a transfer of data were in scope for the GDPR, consent of the data subject (DS) is not the only available lawful basis. GDPR article 6 permits any of several possible lawful bases to be used, particularly paragraph 1 point (f) which reads:
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Also possibly relevant is point (c) which reads:
processing is necessary for compliance with a legal obligation to which the controller is subject;
In short, providing one's personal lawyer with the names and addresses of relevant people in connection with a legal issue is not at all likely to be prohibited by the GDPR, nor to require the consent of the people whose names and contact info are provided.
However, a comment by user PMF reads:
The Data Protection laws are mostly for companies, not for individuals.
This is an overstatement. The laws do apply to natural persons as DCs, although enforcement is largely targeted at businesses, particularly large, for-profit businesses.
