GDPR and personal data reselling
<p>The situation is following:
I had an account in company A which then was sold to company B, both conduct online services.
I wasn't aware of this because I didn't log in to my account for several years, after the login I saw following warning in my mailbox:</p>
<blockquote>
<p>To log in to <strong>A</strong>, connect to an <strong>B</strong> account.</p>
</blockquote>
<blockquote>
<p>We recently sent you an email asking you to confirm which email address you’d like to use with A.</p>
</blockquote>
<blockquote>
<p>Since no email was confirmed, XXXXXX@YYYYYY.com was chosen, and your account was migrated to B account. All other email addresses on your account were removed.</p>
</blockquote>
<blockquote>
<p><em>Connect accounts</em></p>
</blockquote>
<p>Upon communication with the support agent of company B, I realized that there is no process to opt-out and I cannot delete my account without connecting (migrating) to B. Even if I disagree with this acquisition and don't want my account to be migrated, i.e. I did <strong>not</strong> give my consent for such migration.</p>
<p>The company insists that it is GDPR compliant and it obeys all GDPR procedures. Is this true?</p>
<p>How does the above behaviour correlate with:</p>
<ul>
<li><p><strong>Art. 18 GDPR</strong> - <a href="https://gdpr-info.eu/art-18-gdpr/" rel="nofollow noreferrer">Right to restriction of processing</a></p>
</li>
<li><p><strong>Art. 21 GDPR</strong> - <a href="https://gdpr-info.eu/art-21-gdpr/" rel="nofollow noreferrer">Right to object</a></p>
</li>
</ul>
<p>Under the article 21 I have the right to object any actions to my data <em>which is based on point of Art 16</em>, i.e. which are unlawful. Transferring (reselling) my personal data to another controller is not lawful in my opinion. Is my assumption correct?</p>
<p>Don't they violate GDPR by such actions?</p>
<p><strong>P.S</strong>. The company B is international company originally from AU, and it explicitly states that it is GDPR compliant on the dedicated page on its website.</p>
<p>The company A was from US and had no mention of GDPR in privacy policy before acquisition (Jan 2017), so we assume it was not GDPR-compliant.</p>
<p>Pre-acquisition Terms of Use of A: <a href="https://pastebin.com/zXmCdLVQ" rel="nofollow noreferrer">https://pastebin.com/zXmCdLVQ</a><br>
Pre-acquisition Privacy Policy of A: <a href="https://pastebin.com/T2EyX7Fb" rel="nofollow noreferrer">https://pastebin.com/T2EyX7Fb</a></p>

<p>There is a lot going on in this question, so I'll pick out some individual aspects. Last but not least, I'll discuss if GDPR even applies.</p>
<h2>Does the GDPR require consent for X?</h2>
<p>Almost always, no. Consent is only one of many legal bases of processing. A common alternative to consent is a “legitimate interest” where a balancing test is performed between this legitimate interest and your interests, rights, and freedoms. Consent is typically only appropriate if this balancing test fails, for example if you would not reasonably expect this processing activity to occur.</p>
<p>It's worth noting that it's a reasonably common occurrence that businesses are sold or merged. This is not unexpected. In general, you would not be required to consent to such a transfer.</p>
<h2>What can a company do with personal data acquired through a merger/acquisition?</h2>
<p>The GDPR does not provide explicit provisions for this case. But it might be useful to think about the two cases where (a) the new company is a continuation or successor of the original one, and (b) where the data is transferred (“sold”) to an otherwise unrelated company.</p>
<p>In case (a) where the business is continued as normal, there is no change.</p>
<p>In case (b) where data is transferred to a separate company, things are more complicated.</p>
<ul>
<li><p>The original company would need a legal basis for transferring the data. But as mentioned above, there might be a legitimate interest. Arguably, such a transfer could also be based on Art 6(1)(b) if the transfer is <em>necessary</em> to continue to provide the service, for example if the original company would otherwise have to terminate service.</p>
<p>Of course, activities like data brokering where access to data is granted to unrelated third parties would generally fail to be covered by contractual necessity or a legitimate interest, and would probably need consent – but that doesn't seem to be the case here.</p>
</li>
<li><p>When a data controller (such as the new company) acquires your personal data from sources other than directly from you, then they are subject to the notice requirements in Art 14. They have to actively notify you about their processing activities. But because you received emails that mentioned the transfer, this condition might have been met.</p>
<p>Of course the new company continues to be bound by the purpose limitation principle as detailed in Art 6(4) – they can only use the data for purposes that are compatible with the purposes for which the data was initially collected. Thus, the new company cannot arbitrarily widen processing purposes, though some change in scope is certainly permissible.</p>
</li>
</ul>
<h2>How does the GDPR right to object and to restrict processing apply here?</h2>
<p>The Art 21 GDPR right to object means that if the legal basis for a processing activity is a “legitimate interest”, then you can ask for an opt-out. But in some cases, this objection does not have to be granted. An objection essentially requires the controller to repeat the legitimate interest balancing test, taking into account the “grounds relating to [your] particular situation” that you provided in the objection.</p>
<p>The Art 18 GDPR right to restrict processing is an alternative to the right to erasure. It applies only in narrow circumstances, for example while an objection is being checked.</p>
<p>It is likely that you were informed about the transfer to a new company about 1 month in advance, so that you would have been able to prevent this transfer by closing your account prior to the deadline. If the new company conducts processing activities based on a legitimate interest, then their presumably GDPR-compliant privacy notice about which you were notified will certainly explain that you have a right to object.</p>
<h2>Is the new company GDPR-compliant?</h2>
<p>That is impossible to tell, but nothing you've shown so far indicates that they're non-compliant.</p>
<p>My largest issue with this story is that the new company is from Australia, a country with extraordinarily bad privacy protections (as of 2022). However, due to the way how the GDPR treats international transfers of data, this doesn't prevent Australian data controllers from being GDPR-compliant, although it does make it difficult for other companies to use services based in Australia.</p>
<h2>Does GDPR even apply?</h2>
<p>Whether GDPR applies to a non-European company depends only on whether they either offer goods or services to people who are in Europe (“targeting criterion”), and whether the monitor people's behavior that takes place in Europe. Factors such as your citizenship would be irrelevant.</p>
<p>I'll ignore the monitoring criterion, and focus on the targeting criterion. I'll assume that you are in Europe (EU/EEA or UK).</p>
<p>Whether a company is targeting people in Europe depends primarily on the company's intentions. It does not matter whether the service is accessible from Europe.</p>
<p>Thus, it is quite possible that the original company was not subject to the GDPR. Then, any questions about GDPR, consent, and data transfers are moot.</p>
<p>In contrast, the new company clearly mentions GDPR-compliance, which would only matter if they intend for people in Europe to use their services. So GDPR probably applies to them, giving you the full suite of GDPR data subject rights as (hopefully) outlined in their privacy notice. And as long as they notified you that they acquired your personal data in accordance of Art 14, I don't seen anything that they might have done wrong in respect to this acquisition/merger.</p>

<p>GDPR allows you to query what data a company holds on you, and to request deletion if there is no legal justification to retain that data. You should not be required to log into any account to make that request.</p>

gdpr data-protection online personal-information