Personal data is very valuable. That is why it is sometimes said that data is the new oil. Selling personal data can be very profitable for companies. The digital footprint that people leave behind is simply invaluable to marketers and behavioral analysts. To prevent the misuse of personal data, a number of rights and obligations have been included in the General Data Protection Regulation (GDPR). The GDPR does not prohibit the sale of personal data, but it does impose very strict rules.
Valid legal basis for data processing
The GDPR requires a legitimate basis for every form of data processing, including the sale of personal data. For example, the data processing may be necessary for the performance of a contract or to comply with a legal obligation. In practice, reliance is often placed on the free and informed consent of the data subject. Particularly in the case of the sale of personal data, consent is by far the most important legal basis.
The existence of a legitimate interest is also sometimes invoked, but it is essential that this is carefully weighed against the right to privacy of the data subjects. This requires a thorough assessment, taking into account, among other things, legitimate business interests and the impact on the privacy of individuals.
If the consent basis is used, it is important that this consent is free, specific, informed, and unambiguous. This means that people must genuinely have a choice (and therefore not experience adverse consequences if they refuse) and must clearly know exactly what they are consenting to. They must also be adequately informed about the use of their data. Furthermore, they must actively grant this consent. Finally, consent must be revocable at any time.
Selling personal data
If the above conditions are met, companies may sell personal data. However, they must ensure secure data transfer.
The Court of Justice recently issued another interesting ruling regarding the online auction of personal data for advertising purposes (Case C-604/22). In this judgment, it was emphasized once again that the user must first give his or her consent and must be able to object. Anyone who disagrees with the sale of his or her personal data can report this to the Data Protection Authority, the supervisory body that can impose fines.
For example, a bankruptcy trustee may also come into possession of personal data as part of the assets of a bankrupt company. The trustee will likewise not be permitted to simply sell the personal data. He or she will have to verify whether there is a valid legal basis and, if necessary, request consent. Otherwise, the trustee may not sell the personal data. The same applies to, for example, laptops or computers containing personal data. The trustee may only sell these if the personal data has been irreversibly destroyed or if the laptops and computers no longer contain any data carriers.
Advice and support for the sale of personal data
In other words, selling personal data is possible, but subject to very strict regulations. Companies wishing to sell and collect personal data will need to implement both technical and organizational measures to guarantee security and data breaches . Additionally, it is advisable to seek legal advice to ensure there is a valid legal basis and that consent is obtained correctly. You can call upon the expertise of MKB Juristen for this. We will explain the possibilities to you during a no-obligation intake consultation.
