3 ms·

How does GDPR affect selling personal data? Once I've given permission for a company to collect my data, can they just sell it to whoever they want? Is there an

How does GDPR affect selling personal data? Once I've given permission for a company to collect my data, can they just sell it to whoever they want? Is there any way to get rid of that data once it's been sold? Is there any way to find out who's bought it?

michaelbuckbee 8y ago
That's a lot of questions. To sum up, the GDPR is forcing: - granular consent (like you might opt into a newsletter, but not retargeting ads) - right to request what a company knows about you - right to get that data in digital format (json, xml) - right to know when your data is exposed in a data breach - right to request that your data be deleted - right to request that an organization stop processing data about you fwiw - I wrote a bunch more about it (link) and am happy to answer questions. https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
- jon_richards 8y ago
  So as long as there are 1000s of companies like AdUX that purchase my data without telling me or acquiring my consent, I don't really have any hope of actually having my information deleted. I suppose someone could make a service that lets you request every known company delete your info.
  - PeterStuer 8y ago
    If they want to comply all those 1000's of companies will have to get you to reaffirm your consent under the new GDPR rules. Didn't you notice already a lot of the services/sits you use asking you to re-agree ('We've updated our privacy policy etc.')
    - jon_richards 8y ago
      Are you sure that all applies to companies that purchase personal information and not just companies that collect it?
      - dvfjsdhgfv 8y ago
        It applies to all companies that process personal information, where processing also means access.
      - AstralStorm 8y ago
        They also process the data which is explicitly mentioned in GDPR.
      - fasteddie 8y ago
        Yep. If a company purchases PII and then uses it for any reason, say marketing, they have to store how they got consent from the users to use that information.
  - Someone 8y ago
    Under the GDPR, who would they buy it from? A company that sells the data would have to have the user’s consent to sell on their personal data.
DanBC 8y ago
> can they just sell it to whoever they want? No. If you process my data you can only give / sell it to other companies that are GDPR compliant. People keep saying that GDPR means you must have consent, but that's not true for all forms of GDPR compliance. If I have a small business with 5 employees, and I use a company to do payroll, I don't need to get my employee's permission to send their data to the payroll company. I do need to tell them it's happening, and give them the ability to query what data is being held and processed, and to make corrections to incorrect data.

michaelbuckbee 8y ago

That's a lot of questions. To sum up, the GDPR is forcing: - granular consent (like you might opt into a newsletter, but not retargeting ads) - right to request what a company knows about you - right to get that data in digital format (json, xml) - right to know when your data is exposed in a data breach - right to request that your data be deleted - right to request that an organization stop processing data about you fwiw - I wrote a bunch more about it (link) and am happy to answer questions. https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

jon_richards 8y ago
So as long as there are 1000s of companies like AdUX that purchase my data without telling me or acquiring my consent, I don't really have any hope of actually having my information deleted. I suppose someone could make a service that lets you request every known company delete your info.
- PeterStuer 8y ago
  If they want to comply all those 1000's of companies will have to get you to reaffirm your consent under the new GDPR rules. Didn't you notice already a lot of the services/sits you use asking you to re-agree ('We've updated our privacy policy etc.')
  - jon_richards 8y ago
    Are you sure that all applies to companies that purchase personal information and not just companies that collect it?
    - dvfjsdhgfv 8y ago
      It applies to all companies that process personal information, where processing also means access.
    - AstralStorm 8y ago
      They also process the data which is explicitly mentioned in GDPR.
    - fasteddie 8y ago
      Yep. If a company purchases PII and then uses it for any reason, say marketing, they have to store how they got consent from the users to use that information.
- Someone 8y ago
  Under the GDPR, who would they buy it from? A company that sells the data would have to have the user’s consent to sell on their personal data.

DanBC 8y ago

> can they just sell it to whoever they want? No. If you process my data you can only give / sell it to other companies that are GDPR compliant. People keep saying that GDPR means you must have consent, but that's not true for all forms of GDPR compliance. If I have a small business with 5 employees, and I use a company to do payroll, I don't need to get my employee's permission to send their data to the payroll company. I do need to tell them it's happening, and give them the ability to query what data is being held and processed, and to make corrections to incorrect data.