True, but then the data about me you have are useless if you only look at them.
There is no way that you get my data, you sold them to a third part (and here you are already at fault), this third part then share back the data with you for free and then you do nothing with my data, which you asked to begin with. Seriously ?
And I forgot, the third part is at fault too because they have my data without any reasonsand if they get caught they pay a hefty fine.
True, but then the data about me you have are useless if you only look at them.
Marketing data is always kept close by the owners but they sell access or the data would be worthless.
If the original company wants information about you, they don’t download everything from a marketing company. Like using Google, you type in your search and get a result. That search result is used and forgotten. You don’t have to download all of Google to use the results.
The 3rd party wouldn’t be fined because if you knew who they were, you could send them a Gdpr and they would respond. The problem is knowing who these companies are.
Marketing data is always kept close by the owners but they sell access or the data would be worthless.
So your scenario is moot.
The starting point is that company A get my data, then sell them to company B that then share them for free back to company A.
If the original company wants information about you, they don’t download everything from a marketing company. Like using Google, you type in your search and get a result. That search result is used and forgotten. You don’t have to download all of Google to use the results.
If the original company want my informations, it need to ask me the informations (and only the ones needed for the transaction) declaring the use it will do of such informations.
If the original company “googled” my informations, use them to contact my or to try to sell me something, I can ask where they get them and the answer cannot be “we googled them around”. That is why the GDPR ask for an explicit consent to share personal informations with third parties.
There are special cases, like a company need to share information with a payment gateway or to retain information for a longer period as dictated by some other laws, but generally a company, without an explicit permission, need ask only the information needed for the transaction and to keep the informations only the time it need to complete the transaction. And even with an explicit permission it can not keep the information for more that a given number of years (3 if I remember correctly) without asking for permission again with the default as “if I don’t answer, my answer is no”.
The 3rd party wouldn’t be fined because if you knew who they were, you could send them a Gdpr and they would respond.
Your starting point is that I don’t know who the third part is and I don’t know my data were sold.
But te 3rd party would be fined if they were found with my data without being able to offer my persmission to have them when asked.
The problem is knowing who these companies are.
The GDPR state that any company must list all the 3rd parties it shares data with.
They don’t have to tell you shit, and they don’t. Only in CA do they even tell you if your information was stolen, unless it’s going to come out in the news and they don’t want to look like what they are.
Worst case, if they got prosecuted, they’d negotiate a fine and not admit responsibility so no one could use the government’s case for a civil suit.
So you pay because you have my data without any reasons and because you sold them.
I don’t have any data. A third party has your data. But you don’t know that.
You said that the third part shared my data with you after you sold them to them, this means that you have my data.
Access to data isn’t the same as having data. You can watch a YouTube video but that doesn’t mean you downloaded it and have it.
True, but then the data about me you have are useless if you only look at them.
There is no way that you get my data, you sold them to a third part (and here you are already at fault), this third part then share back the data with you for free and then you do nothing with my data, which you asked to begin with. Seriously ?
And I forgot, the third part is at fault too because they have my data without any reasonsand if they get caught they pay a hefty fine.
Marketing data is always kept close by the owners but they sell access or the data would be worthless.
If the original company wants information about you, they don’t download everything from a marketing company. Like using Google, you type in your search and get a result. That search result is used and forgotten. You don’t have to download all of Google to use the results.
The 3rd party wouldn’t be fined because if you knew who they were, you could send them a Gdpr and they would respond. The problem is knowing who these companies are.
So your scenario is moot.
The starting point is that company A get my data, then sell them to company B that then share them for free back to company A.
If the original company want my informations, it need to ask me the informations (and only the ones needed for the transaction) declaring the use it will do of such informations.
If the original company “googled” my informations, use them to contact my or to try to sell me something, I can ask where they get them and the answer cannot be “we googled them around”. That is why the GDPR ask for an explicit consent to share personal informations with third parties.
There are special cases, like a company need to share information with a payment gateway or to retain information for a longer period as dictated by some other laws, but generally a company, without an explicit permission, need ask only the information needed for the transaction and to keep the informations only the time it need to complete the transaction. And even with an explicit permission it can not keep the information for more that a given number of years (3 if I remember correctly) without asking for permission again with the default as “if I don’t answer, my answer is no”.
Your starting point is that I don’t know who the third part is and I don’t know my data were sold.
But te 3rd party would be fined if they were found with my data without being able to offer my persmission to have them when asked.
The GDPR state that any company must list all the 3rd parties it shares data with.
They don’t have to tell you shit, and they don’t. Only in CA do they even tell you if your information was stolen, unless it’s going to come out in the news and they don’t want to look like what they are.
Worst case, if they got prosecuted, they’d negotiate a fine and not admit responsibility so no one could use the government’s case for a civil suit.