On December 28, 2018, the French Data Protection Agency, the Commission Nationale de l’informatique et des Libertés (CNIL) published several principles to help companies comply with the General Data Protection Regulation (GDPR) while transferring personal data to their commercial partners for electronic prospecting.
Particularly, the CNIL highlights how:
- the data subject must give consent before the data is transmitted to third parties;
- the data subject must be able to know who the data are transferred to;
- the data subject must be informed of any change of partners and of her right to object to data processing;
- the commercial partners cannot in turn transfer the collected data to other partners without collecting again the informed consent of the data subject;
- the receiving third parties must indicate to the data subject – at their first communication – how to exercise their rights, in particular of opposition, as well as the source from which the data came from.
The CNIL guidance is available (in French) at https://www.cnil.fr…
For more information and assistance on privacy, data protection, and GDPR, Francesca Giannoni-Crystal and Federica Romanelli.