GDPR and personal data reselling The situation is following: I had an account in company A which then was sold to company B, both conduct online services. I wasn't aware of this because I didn't log in to my account for several years, after the login I saw following warning in my mailbox: To log in to A, connect to an B account. We recently sent you an email asking you to confirm which email address you’d like to use with A. Since no email was confirmed, XXXXXX@YYYYYY.com was chosen, and your account was migrated to B account. All other email addresses on your account were removed. Connect accounts Upon communication with the support agent of company B, I realized that there is no process to opt-out and I cannot delete my account without connecting (migrating) to B. Even if I disagree with this acquisition and don't want my account to be migrated, i.e. I did not give my consent for such migration. The company insists that it is GDPR compliant and it obeys all GDPR procedures. Is this true? How does the above behaviour correlate with: Art. 18 GDPR - Right to restriction of processing Art. 21 GDPR - Right to object Under the article 21 I have the right to object any actions to my data which is based on point of Art 16, i.e. which are unlawful. Transferring (reselling) my personal data to another controller is not lawful in my opinion. Is my assumption correct? Don't they violate GDPR by such actions? P.S. The company B is international company originally from AU, and it explicitly states that it is GDPR compliant on the dedicated page on its website. The company A was from US and had no mention of GDPR in privacy policy before acquisition (Jan 2017), so we assume it was not GDPR-compliant. Pre-acquisition Terms of Use of A: https://pastebin.com/zXmCdLVQ Pre-acquisition Privacy Policy of A: https://pastebin.com/T2EyX7Fb
There is a lot going on in this question, so I'll pick out some individual aspects. Last but not least, I'll discuss if GDPR even applies. Does the GDPR require consent for X? Almost always, no. Consent is only one of many legal bases of processing. A common alternative to consent is a “legitimate interest” where a balancing test is performed between this legitimate interest and your interests, rights, and freedoms. Consent is typically only appropriate if this balancing test fails, for example if you would not reasonably expect this processing activity to occur. It's worth noting that it's a reasonably common occurrence that businesses are sold or merged. This is not unexpected. In general, you would not be required to consent to such a transfer. What can a company do with personal data acquired through a merger/acquisition? The GDPR does not provide explicit provisions for this case. But it might be useful to think about the two cases where (a) the new company is a continuation or successor of the original one, and (b) where the data is transferred (“sold”) to an otherwise unrelated company. In case (a) where the business is continued as normal, there is no change. In case (b) where data is transferred to a separate company, things are more complicated. The original company would need a legal basis for transferring the data. But as mentioned above, there might be a legitimate interest. Arguably, such a transfer could also be based on Art 6(1)(b) if the transfer is necessary to continue to provide the service, for example if the original company would otherwise have to terminate service. Of course, activities like data brokering where access to data is granted to unrelated third parties would generally fail to be covered by contractual necessity or a legitimate interest, and would probably need consent – but that doesn't seem to be the case here. When a data controller (such as the new company) acquires your personal data from sources other than directly from you, then they are subject to the notice requirements in Art 14. They have to actively notify you about their processing activities. But because you received emails that mentioned the transfer, this condition might have been met. Of course the new company continues to be bound by the purpose limitation principle as detailed in Art 6(4) – they can only use the data for purposes that are compatible with the purposes for which the data was initially collected. Thus, the new company cannot arbitrarily widen processing purposes, though some change in scope is certainly permissible. How does the GDPR right to object and to restrict processing apply here? The Art 21 GDPR right to object means that if the legal basis for a processing activity is a “legitimate interest”, then you can ask for an opt-out. But in some cases, this objection does not have to be granted. An objection essentially requires the controller to repeat the legitimate interest balancing test, taking into account the “grounds relating to [your] particular situation” that you provided in the objection. The Art 18 GDPR right to restrict processing is an alternative to the right to erasure. It applies only in narrow circumstances, for example while an objection is being checked. It is likely that you were informed about the transfer to a new company about 1 month in advance, so that you would have been able to prevent this transfer by closing your account prior to the deadline. If the new company conducts processing activities based on a legitimate interest, then their presumably GDPR-compliant privacy notice about which you were notified will certainly explain that you have a right to object. Is the new company GDPR-compliant? That is impossible to tell, but nothing you've shown so far indicates that they're non-compliant. My largest issue with this story is that the new company is from Australia, a country with extraordinarily bad privacy protections (as of 2022). However, due to the way how the GDPR treats international transfers of data, this doesn't prevent Australian data controllers from being GDPR-compliant, although it does make it difficult for other companies to use services based in Australia. Does GDPR even apply? Whether GDPR applies to a non-European company depends only on whether they either offer goods or services to people who are in Europe (“targeting criterion”), and whether the monitor people's behavior that takes place in Europe. Factors such as your citizenship would be irrelevant. I'll ignore the monitoring criterion, and focus on the targeting criterion. I'll assume that you are in Europe (EU/EEA or UK). Whether a company is targeting people in Europe depends primarily on the company's intentions. It does not matter whether the service is accessible from Europe. Thus, it is quite possible that the original company was not subject to the GDPR. Then, any questions about GDPR, consent, and data transfers are moot. In contrast, the new company clearly mentions GDPR-compliance, which would only matter if they intend for people in Europe to use their services. So GDPR probably applies to them, giving you the full suite of GDPR data subject rights as (hopefully) outlined in their privacy notice. And as long as they notified you that they acquired your personal data in accordance of Art 14, I don't seen anything that they might have done wrong in respect to this acquisition/merger.
I'm not aware of any cases on point, but as a rule legal fig-leaves don't play well in court. If the webmaster simply puts up a banner saying that EU residents are not permitted but takes no other action to exclude them, then that is going to be considered irrelevant. The webmaster is still very likely required to comply with the GDPR. On the other hand if the webmaster takes other steps to exclude EU residents, such as using a geolocation service to block connections known to be in the EU, validating email addresses and blocking those from EU domains, and ejecting anyone who mentions that their residence is in the EU, then that is more likely to be seen as a good-faith attempt to avoid being subject to the GDPR. It will also have the practical effect of greatly reducing the number of actual EU residents. All these controls can be evaded, but it would be much harder for any data subjects to claim that they acted in good faith or that the webmaster acted in bad faith. Note that validating an email address or logging an IP is itself processing of personal data, so anyone implementing such a system still can't ignore the GDPR completely, but it would greatly limit the scope and make it easy to delete any such data after a short time. (Note: the term &quot;EU resident&quot; above is an approximation of the territorial scope).
Mailchimp as a company is probably mostly GDPR-compliant. But this doesn't mean that using the Mailchimp service would be compliant as well. This is because the GDPR has different compliance obligations for “data controllers” and “data processors”. The data controller is responsible for the compliance of all processing activities they determine the purposes and means for, regardless of whether those activities are actually outsourced. In contrast, the primary responsibility of a data processor is to only use the data as instructed by the controller, but not for the processor's own purposes. So Mailchimp probably doesn't abuse its customer's data, and offers an Art 28 GDPR conformant data processing agreement as part of its contracts. Mailchimp also offers features that assist with related privacy laws, such as collecting proper consent as required by the EU ePrivacy Directive. And Mailchimp has a page about European data transfers. This is where it gets tricky. Not the Mailchimp service, but the customer is the data exporter / data controller and is responsible for compliance with Chapter V of the GDPR. The data controller must decide themselves whether the international transfer into the US is legal. Briefly, the GDPR allows the following grounds for an international transfer of personal data: target country has an adequacy decision from the EU – no, because the EU–US Privacy Shield was invalidated in the Schrems II ruling Standard Contractual Clauses (SCCs) – maybe, see below discussion Binding Corporate Rules – not applicable exceptions, including explicit consent or only occasional transfers – not applicable The Mailchimp guide about EU data transfers correctly states that the Schrems II decision only invalidated the Privacy Shield, and did not invalidate the concept of SCCs. That means it is still legal to use SCCs as a basis to transfer personal data in non-EU countries. But this doesn't imply that SCCs can serve as a basis for transferring personal data specifically to Mailchimp in the US – a case by case analysis is necessary that determines whether security of processing is guaranteed and whether data subjects would have effective legal remedies if their rights were breached. It now happens that exactly the same reasons that caused the Privacy Shield to be invalid must also make us doubt whether SCCs can be valid in their place. The problem with transfers to the US never was the risk that the recipient would sell the personal data to the highest bidder, but that the US-based company is subject to US spy laws like FISA 702 and EO 12333 that do not provide effective legal remedies for foreign affected persons. (Mailchimp explicitly confirms that it is subject to those spy laws as an “electronic communication service”.) In the wake of the Schrems II ruling the EDPB has published a document with recommendations for supplemental safeguards that could make SCCs permissible, but these recommendations (like end to end encryption, or only transferring pseudoymized data) cannot work for US-based cloud services such as Mailchimp. Some (such as the US government) have argued that Schrems II was based on outdated information, but this standpoint is not shared by European regulators. So, the data controller – the Mailchimp customer – has to make their own judgement about this international transfer. If SCCs combined with Mailchimp's supplemental measures provide sufficient safeguards, then the international transfer is legal and GDPR-compliant. Mailchimp offers all the necessary paperwork such as DPAs, SCCs, and so on. If there are no sufficient safeguards, then the transfer is clearly illegal. My personal opinion is that Mailchimp's supplemental measure fall far short of what would be required per the EDPB recommendations. Lower courts in the EU now routinely consider all transfers to the US as illegal. A company using Mailchimp was also an early target of a post-Schrems II enforcement action, though it wasn't fined since it immediately stopped using the service. So while it's not possible to definitely say that using Mailchimp would be a GDPR-violation, it's very difficult to argue that such use could be compliant.
This is clearly personal information (PI) , and indeed personally identifiable information (PII). and so is Personal Data under the GDPR. Under Article 6 of the GDPR any processing must have a lawful basis. There are 6 possible bases. The most likely ones here would be (a) consent, or (f) legitimate interst, but the private association may claim some other basis as well. They should tell you what basis or bases justify their processing of this information, which includes storing it and publishing it. Under Article 13, Paragraph 1(c) the association should have informed you of the purposes for which information was collected when it was first collected. Under Article 15 paragraph 1 you are entitled to request and obtain from the association (or any other Data Controller) a statement of what PI about you they hold. along with this they must supply various other information including; (a) the purposes of the processing; (b)the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; and other specified information. Article 17 paragraph 1 provides that: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay ... if one the the specified conditions applies, particularly: 1(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; 1(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) Article 21 paragraph 1 provides that: The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Thus I would suggest that you send a written communication to the association, stating that you: Request access to all PI which they have about you, as permitted by GDPR article 15 paragraph 1; Request that they delete any such information from the public website and any other publications, as permitted by GDPR article 17 paragraph 1; State that you object to further processing of this information under GDPR article 21 paragraph 1; Request information on the name and contact info of the relevant supervisory authority under GDPR article 15 paragraph 1; State that you expect these requests to be complied with promptly, in no event later than 30 days. Mention your prior request for the public info to be deleted, and that several months have already elapsed. Give the exact date of the prior request. I would suggest sending these requests, together in a single email, specifically mentioning the relevant GDPR provisions. I would suggest sending a copy of this by registered mail, and retaining a copy, along with the identifying number of the registered letter. In the letter, mention the email. If the association does not promptly respond in a way you consider satisfactory, you may wish to file a complaint with the relevant data protection supervisory authority. You may also wish to consult a lawyer with experience in this area to determine if you have any legal recourse if the association does not comply.
No, GDPR does not apply here — but other laws might . The General Data Protection Regulation only concerns itself with the following: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. per Article 2. Furthermore, there is a specific exemption (Art. 2 (2)(c)) which would seem to apply to you (emphasis mine): This Regulation does not apply to the processing of personal data: (a) in the course of an activity which falls outside the scope of Union law; (b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. You are sharing the conversation in a purely personal capacity and are not processing it wholly or partly through automated means nor are you intending it to form part of a filing system. Additionally, depending on the contents of the conversation and what you share, there may not be any personal data involved at all. For example, if you only share the messages themselves (and they don't contain any personal data that could identify someone) and censor/black out any names or photographs/avatars from the senders. Either way, GDPR does not appear to apply to you in this context. However, it appears that Article 18.1 of the Spanish Constitution grants the right to &quot;personal and family privacy&quot;, as does the Organic Act 1/982 on Civil Protection of the Right to Honour, Personal and Family Privacy, and Self-Image. It's possible that, depending on the contents of the conversation, the other party involved in the conversation may have a case for action against you in the civil or criminal courts (for example, if the information invades their privacy or is defamatory in some way) if you share the contents of the conversation with someone else. I am not familiar with Spanish law so cannot comment further on this matter.
Your confusion might be caused by the fact that even with a contract, only the data necessary for that contract is covered under the GDPR. So yes, while there might be an &quot;execution of contract&quot; under the T&amp;C, this would only cover necessary data. That means you can't ask arbitrary signup data under the guise of a contract. If you need to deliver a physical product, you can store a physical address. If it's an online service, you can store an email address or similar handle. But you can't mix the two. A physical address is unnecessary for the execution of a contract that's not physical in nature. Now, you mention &quot;consent&quot;. Under GDPR, this is a distinct justification besides &quot;execution of contract&quot;. You might have consent to store a physical address in addition to an online address, e.g. if you offer a customer to physically mail a password request form. This consent is additional to the contract. Also note that the bit above only covers the lawful reasons for the processing of personal data (article 6). You also have to obey the other GDPR rules, e.g. fully inform the user, make sure that consent is freely given, etc.
First of all, although the GDPR is stated to apply to any site which processes the data of any person who is in the EU, it is not clear how a site not located in the EU, does not business in the EU, and does not primarily target EU residents as its audience can be required to comply with the GDPR. To the best of my knowledge, no such case has yet been brought, much less decided. There has also been some debate on whether an IP address constitutes Personal Data under the GDPR, and if it always does so, or only under particular conditions. The European Court of Justice (ECJ) held that (under the predecessor Directive 95/46/EC) that a dynamic IP address was personal data. But in that case the web site was run by the German Federal Government, which surely has wider scope for getting info from a German ISP than a small private US web activist does. There is not yet any case law that I know of on the applicability of the GDPR to IP addresses in any case at all similar to the one in the question. Joe would in my view be wise to at least learn that logs are being kept, and post a disclosure of this on the site. Whether Joe needs to do more than that is less than clear at this time.
If the website containing the GDPR-wall processes any personal data of users who hit the GDPR-wall, the GDPR applies to that website. This can be as simple as writing a logfile of all visits to the website. In this case it will be illegal if the website owner does not comply with the GDPR. However a supervisory authority would probably not spent any time on such a minor violation. As long as the the website with the GDPR-wall does not process any personal data, the GDPR does not apply, so nothing in the GDPR can forbid the GDPR-wall. Some related remarks: The GDPR does not require a "privacy policy" on the website if the website does not process any personal data. If personal data is processed based on consent, that consent must be freely given. Also it may not be disruptive. So a cookie wall asking for consent would be illegal. But the GDPR does not care about any other disruptive popups, as long as they are not related to asking for consent. Using GeoIP is a perfect way to implement such a GDPR-Wall, because it would block everyone from within the EU, but nobody else. So it blocks exactly those for who the GDPR would apply. In such a case it would not be reasonable to expect anything more from a website owner. A user which uses a proxy, can not expect to be protected by the GDPR, because it bypasses a restriction set by the owner of the website. A webserver does use the IP-address of all incoming requests, to send the reply back. That could be considered a processing of personal data, but everybody seems to agree it is not. I am not sure why. But I do agree that it would be very impractical if that is considered processing of personal data. I added an example from the Washington Post So you have to pay $9/month for a GDPR compliant subscription. Because the price you have to pay is not unacceptable high, I think it would be valid to offer the premium version this way. This does not force you to choose one of the other subscriptions. In december 2018, the Austrian DPA (DSB) has confirmed that a similar offer is lawful. On derstandard.at you get a choice between free access with tracking and advertising, or pay 6 Euro/Month for tracking free access. Because 6 Euro/Month is cheaper than subscribing to the printed edition, the DSB accepted that as a valid choice. More information can be found on noyb.eu or, (with more details but in German), on wbs-law.de.