Legal sending personal information to a third party if the user supplied incorrect contact information?
<p>To clarify the title, here is an example:</p>

<ol>
<li>Alice wants to sign up to online store Nile.com</li>
<li>Alice enters the email <code>bob@mailprovider.com</code> by accident</li>
<li>Nile.com does <strong>not</strong> send a verification that Alice has to complete but directly accepts the registration and the email</li>
<li>Alice orders stuff from Nile.com</li>
<li>Bob, who is completely unrelated to Alice, starts getting emails that contain information about Alice that includes her name, (delivery) address and purchases</li>
</ol>

<p>I tried to look through <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1528874672298&amp;uri=CELEX%3A32016R0679" rel="nofollow noreferrer">the entire text</a> but I honestly got lost around the processing sections. The only relevant part I noticed was in Chapter II, article 5</p>

<blockquote>
  <ol>
  <li>Personal data shall be:</li>
  </ol>
  
  <p>[...]</p>
  
  <p>(d) <strong>accurate</strong> and, where necessary, kept up to date; every
  reasonable step must be taken to ensure that personal data that are
  inaccurate, having regard to the purposes for which they are
  processed, are erased or rectified without delay (‘accuracy’);</p>
  
  <p>[...]</p>
  
  <p>(f) processed in a manner that ensures appropriate security of the
  personal data, including <strong>protection against</strong> unauthorised or unlawful
  processing and against <strong>accidental loss</strong>, destruction or damage,
  using appropriate technical or organisational measures (‘integrity and
  confidentiality’).</p>
</blockquote>

<p>(emphasis mine)</p>

<p>What are the legal obligations of Alice and Nile.com here? It is ultimately Alice who made the mistake and Nile are following the user's preference for contact, even if it's wrong. I couldn't see (or I missed) if Alice has an obligation to provide accurate data. At the same time it seems like Nile.com should have done due diligence before essentially leaking (is this considered "accidentally losing"?) PII to a third party. </p>

<p>The Company needs to ensure the identification of the person who provides the Personal Data as the Data Subject (as per Article 13) or, when the Data is known by the company to have been gathered from another source than the Data Subject to observe by Article 14 and inform the Data Subject while asking for his/ her Consent.
So, in this case, the company is the one that breached GDPR by having not identified the person inputting the Data as the Data Subject... which can be easily accomplished with two-factor authentication (just as an example).
Alice may have acted on purpose, yet that is not within the scope of GDPR in this case... it may be within the scope of civil prosecution by Bob... but that is too farfetched.</p>

privacy gdpr european-union