4 ms·

IANAL - I don't believe acquiring another company and the PII along with it is necessary a GDPR violation. Article 14 of GDPR[0] lays out the requirements for w

IANAL - I don't believe acquiring another company and the PII along with it is necessary a GDPR violation. Article 14 of GDPR[0] lays out the requirements for what a company needs to do when a company acquires personal data, not directly from the data subject. I believe this is what applies when a company acquires another company. At first glance, it appears the email Scribd sent does comply with most of article 14 such as: - They notified you they were acquiring your personal data. - They notified you are able to opt out. The email is missing a few things such as the legal basis for processing. The email links to the privacy policy and an FAQ, which might be enough to provide that information. I'm not sure. Since Scribd is not processing the data for a purpose other than what it was collected for (they mention this in the email), continuing to process it for the original purpose is ok. Presumably SlideShare complied with article 6 of GDPR[1] and either asked for consent or used one of the other bases for processing the data before the acquisition. [0] https://gdpr-info.eu/art-14-gdpr/ https://gdpr-info.eu/art-14-gdpr/ [1] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

user5994461 6y ago
>>> The email links to the privacy policy and an FAQ, which might be enough to provide that information. I'm not sure. Plot twist: The link was broken. Had to use google to find the FAQ page on how to unlink linkedin with slideshare and delete the account. It's not trivial to do.
mnw21cam 6y ago
> Since Scribd is not processing the data for a purpose other than what it was collected for I disagree with that. Also, could you point out the bit in the email where it says so. If I sign up for LinkedIn and provide PII for that, then the purpose for which the PII can be processed is in order to handle my interaction with LinkedIn. If I signed up to LinkedIn before 2012, and LinkedIn bought Slideshare in 2012, then LinkedIn could only claim that my PII is still being processed for its original purpose when used by Slideshare if Slideshare was made an integral part of LinkedIn. If Slideshare is then sold to a third party, then it definitely is not an integral part of LinkedIn, and applying my PII in its operation is not processing it for the purpose it was originally collected for. LinkedIn does not have the legal right to bundle my PII in its sale of Slideshare to Scribd, and even if Scribd were to receive my PII, it would not legally be able to use it.

user5994461 6y ago

>>> The email links to the privacy policy and an FAQ, which might be enough to provide that information. I'm not sure. Plot twist: The link was broken. Had to use google to find the FAQ page on how to unlink linkedin with slideshare and delete the account. It's not trivial to do.

mnw21cam 6y ago

> Since Scribd is not processing the data for a purpose other than what it was collected for I disagree with that. Also, could you point out the bit in the email where it says so. If I sign up for LinkedIn and provide PII for that, then the purpose for which the PII can be processed is in order to handle my interaction with LinkedIn. If I signed up to LinkedIn before 2012, and LinkedIn bought Slideshare in 2012, then LinkedIn could only claim that my PII is still being processed for its original purpose when used by Slideshare if Slideshare was made an integral part of LinkedIn. If Slideshare is then sold to a third party, then it definitely is not an integral part of LinkedIn, and applying my PII in its operation is not processing it for the purpose it was originally collected for. LinkedIn does not have the legal right to bundle my PII in its sale of Slideshare to Scribd, and even if Scribd were to receive my PII, it would not legally be able to use it.