When are you allowed to pass on personal data to a third party?

You may only transfer personal data to a third party if that third party demonstrates a legitimate interest, there is no less intrusive way to obtain the data, and a balancing of interests weighs in their favor. If a third party fails to provide substantiation, you are in principle not obliged (and often not even authorized) to disclose the data. If you disclose it too easily, you risk fines and damage claims under privacy legislation. Below, you can read for each situation when transferring data is permitted and when it is not, with examples from case law and a concrete step-by-step plan.

When are you allowed to share personal data with a third party?

Almost every company collects and processes personal data from customers, users, or suppliers. This entails obligations under the General Data Protection Regulation (GDPR): you must properly secure this data and ensure that it does not leak. But what if a third party approaches you and asks for data, for example to collect a debt or file a claim for damages? Are you obliged to comply?

There is no ready-made “yes” or “no.” Whether you may share data depends on the specific circumstances. Case law has developed a number of clear criteria for this. In short, the basic principle applies: do not disclose data unless all conditions are met. Do you first want to understand which rules apply to your processing activities in general? Then read more about privacy and data protection for entrepreneurs.

The criteria from the Lycos/Pessers judgment

In the well-known Lycos/Pessers (Supreme Court, 25 November 2005, ECLI:NL:HR:2005:AU4019), the Supreme Court ruled on a similar situation. This judgment remains one of the most important rulings in this field. A third party suffered damage due to accusations published on a website and wished to obtain the NAW details (name, address, place of residence) of the website owner via the hosting provider. The Supreme Court formulated a set of criteria that still form the starting point. Only if these conditions are metcan a provider or company be obliged to provide the data.

The four core criteria are:

• It is sufficiently plausible that the information or conduct in question unlawful and harmful to the third party.
• The third party has a legitimate interest in obtaining the data.
• It is plausible that in the specific case there no less intrusive way to obtain the data.
• After a balancing of interests between the third party, the disclosing party, and the person whose data is concerned, the interest of the third party outweighs that of the third party.

Regarding that last point, for example, factors to consider include whether release could lead to reputational damage or an infringement of the data subject's privacy. It is therefore a matter of tailor-made solutions: you assess each request on its own merits. It is also important that an intermediary cannot hide behind an absolute refusal policy. If all criteria are met and you refuse anyway, you could be held liable yourself.

Judges assess legitimate interest strictly

That judges do not treat these criteria lightly is evident from subsequent case law. In a case before the Amsterdam District Court, a seller on Marktplaats wanted to obtain the details of the person who had placed a winning bid of six thousand euros on a lot of stamps. According to the seller, a purchase agreement had been concluded through the bid and acceptance.

The judge did not agree with this, because the platform's terms of use stipulated that bids are not binding. Without a valid agreement, there was insufficient grounds to disclose the personal data. The platform was therefore not obliged to provide the data.

Only if an agreement had actually been reached and the other criteria had been met could the situation have been different. But even then, the seller himself would have had to prove his legitimate interest, and the platform would have had to ascertain whether less intrusive options were available, for example, whether the seller had already attempted to make contact via the chat function. And even then, the balancing of interests remains.

The balancing of interests may turn out in favor of the private individual

Another case involving Marktplaats demonstrates just how much weight that balancing of interests carries. In the Stokke/Marktplaats , manufacturer Stokke requested the data of advertisers offering high chairs. This concerned sellers of alleged counterfeit goods, which supposedly infringed Stokke's trademark rights.

The judge ruled that Stokke's interest was smaller than the privacy interest of the private advertisers. After all, Stokke continuously monitored the listings and reported infringements, after which the platform took them offline almost immediately. The remaining damages were too limited to outweigh the privacy of private individuals. Case law attaches significant weight to the privacy rights of private individuals.

What risks do you run if you share data too easily?

Transferring personal data without a valid legal basis is itself processing under the GDPR. If you do so incorrectly, you may face:

• Supervision and enforcement by the Dutch Data Protection Authority, resulting in possible fines.
• Damage claims from the data subject whose data has been unlawfully shared.
• Reputational damage and loss of trust among customers and users.

Conversely, if you reject a legitimate request under duress from a judge, this can also have negative consequences. It is therefore important to assess every request carefully and in a verifiable manner. You can read more about the amount and likelihood of sanctions in our article on privacy fines.

Step-by-step plan: how to assess a request from a third party

Do you receive a request for personal data from a third party? Then follow these steps before disclosing anything:

1. Request substantiation. Have the third party demonstrate that he has a legitimate, real interest.
2. Assess the unlawfulness. Is it sufficiently plausible that there has been unlawful and harmful conduct?
3. Explore alternatives. Check whether the third party can obtain the data in a less intrusive way.
4. Conduct a balancing of interests. Weigh the interest of the third party against the privacy of the data subject and your own position.
5. Record your decision. Document why you do or do not provide, so that you can justify your choice later.

Do you want to make clear agreements in advance about sharing data with other organizations? Then record this in a data exchange agreement, so that the purpose, legal basis, and conditions are clear.

Frequently Asked Questions

Am I obliged to provide personal data if a third party requests it?

Not automatically. In principle, you do not disclose data unless the third party demonstrates a legitimate interest, there is no less intrusive alternative, and the balancing of interests weighs in their favor. Only when those conditions are met can an obligation arise, sometimes through a court ruling.

What constitutes a legitimate interest in requesting data?

That is a concrete and real interest, for example, collecting a debt or recovering damages caused by unlawful conduct. A vague suspicion or mere curiosity is not sufficient. The third party must be able to substantiate their interest.

Which data is usually requested?

This often involves name, address, and place of residence details that allow a third party to identify or contact a person, for example, to initiate legal proceedings. Other identifying information may also be requested.

What happens if I share data incorrectly?

In that case, you are processing personal data without a valid legal basis. This can lead to enforcement by the Dutch Data Protection Authority, fines, and damage claims from the data subject. Therefore, always assess a request carefully and document your assessment.

Do I need to involve a judge before releasing data?

Not always, but it is wise to do so when in doubt. A third party can demand the release of data through the courts. If you voluntarily release data while the criteria have not been met, you bear the risk of unlawful processing yourself. Legal advice beforehand prevents wrong choices.

Am I allowed to share customer data with a debt collection agency to collect an unpaid invoice?

To collect a debt of your own, you generally have a legal basis to share necessary data with an engaged party, provided you only share what is necessary and make clear agreements. Releasing data to an outsider upon request is a different matter: the stricter criteria set out in this article apply in that case. Is an invoice mounting and do you want to hand it over to a third party? Then take a look at our debt collection for entrepreneurs.

Are you unsure? Seek advice first

Both the legislature and the judiciary attach great importance to the privacy protection of your users and customers. If you receive a request for personal data, first have the third party demonstrate a legitimate interest, investigate whether less intrusive options are available, and conduct a careful balancing of interests. You may only release data if all those indications are favorable.

Unsure whether you are allowed to share data in a specific case? Our corporate lawyers are happy to advise you and assess the request together with you. View our legal assistance for entrepreneurs or schedule an intake meeting directly.