GDPR Acquisitions

[alyseweaver]

If a person subscribes to company ABC, but ABC is acquired by company XYZ, does XYZ has the ability to email those contacts? Must they be reverified by XYZ? How do GDPR rules apply to these instances?  

[warrendavey · Accepted solution]

@alyseweaver - If the email addresses themselves haven't changed then you shouldn't be obligated to reverify. That would be on their end.  If the email changes then you would probably need to have them verify for any subscription as part of your normal process in adding a new email.

Non-Disclosure: I have no background in GDPR and am not authorized to provide legal advice. Please check with a legal professional in addition to these suggestions. 🙂

[GDHutchison · Accepted solution]

Below are the regulations around consent from the ICO - You will need to infiorm the contacts as the controller of the data has changed and thefore consent needs to reverified.

What is ‘specific and informed’?

Consent needs to be specific and informed. This means it must specifically cover the following:

• The controller’s identity: recital 42 says the individual should know the identity of the controller. This means you need to identify yourself, and also name any third party controllers who will be relying on the consent. If you buy in ‘consented’ data, that consent is only valid for your processing if you were specifically identified. You don’t need to name your processors in your consent request (although you do need to comply with separate transparency obligations).

• The purposes of the processing: recital 43 says separate consent will be needed for different processing operations wherever appropriate – so you need to give granular options to consent separately to separate purposes, unless this would be unduly disruptive or confusing. And in every case, a consent request must specifically cover all purposes for which you seek consent.

• The processing activities: again, where possible you should provide granular consent options for each separate type of processing, unless those activities are clearly interdependent – but as a minimum you must specifically cover all processing activities.

• The right to withdraw consent at any time: we also advise you should include details of how to do so.

[warrendavey · Accepted solution]

@alyseweaver - If the email addresses themselves haven't changed then you shouldn't be obligated to reverify. That would be on their end.  If the email changes then you would probably need to have them verify for any subscription as part of your normal process in adding a new email.

Non-Disclosure: I have no background in GDPR and am not authorized to provide legal advice. Please check with a legal professional in addition to these suggestions. 🙂