Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?
<p>How does GDPR apply to companies getting someone else's personal data from a legitimate source?</p>

<p>For an example: If I have an app on my phone that wants access to my contacts, (let's say it's a messaging app) can the company store personal information about the other person (e.g. their email address) obtained from me as a private, personal individual?</p>

<p>If so, do they need to notify the other individual, like as if it was obtained from a third party company?</p>

<p>Let's assume the app relied on obtaining the personal information from me under legitimate interests or consent, does it automatically follow that the personal information about the other person is on the same lawful basis or can it be a stronger one? Can they invoke the right to erasure or object, even if that will interfere with my usage as another customer?</p>

<p>I don't have an app: This question was inspired by the BBC GDPR quiz: <a href="http://www.bbc.co.uk/news/technology-44224802" rel="noreferrer">http://www.bbc.co.uk/news/technology-44224802</a>
Which has a question on the topic, but no detailed information.</p>

<p>So, I got on chat and asked a support agent of the information commissioners office (UK). Posting the responses here in case anyone else wants to see.</p>

<blockquote>
  <p>If they obtain personal data from a source other than the data they
  will have to provide privacy information unless there is an extremely
  good reason not to. Their lawful basis might be the same as for you or
  it might be different. They clearly will not be able to rely on
  consent. The rights such as right to erasure and right to object will
  still be available if the criteria to comply with such a request are
  met</p>
</blockquote>

<p>I asked them if it meant that, e.g. Whats app would need to contact people on others contact list, the answer was</p>

<blockquote>
  <p>It seems to me that that should happen but there are some possible
  exemptions to providing privacy data under Article 14.</p>
</blockquote>

<p>When asked which exclusion would be relevant:</p>

<blockquote>
  <p>I am not saying any [exclusion] would apply in this case. I am saying those are
  the ones that exist and if a data controller chose not to provide the
  information they would have to identify one of the exemptions or
  explain another reason they had not done so.</p>
</blockquote>

<p>If anyone has a further answer on what exclusion is most likely to apply I'd be happy to hear it!</p>

gdpr