Data protection is a delicate matter

Data protection is a tricky issue in times of big data and ever more sophisticated data analysis tools such as Google Analytics. A well-known online information service also had to learn this. When its owner acquired another online information service with a related industry focus, the two companies entered into a strategic partnership. This resulted in a joint service package that needed to be advertised. What could be more obvious than to make the new joint service appealing to existing subscribers of the acquired service in a personally addressed letter?Data may only be passed on to third parties with express consentThe Terms & Conditions on the website of the purchased information service clearly and unambiguously state: "Personal data entered on this website, such as contact forms, will be treated confidentially and will not be passed on to third parties." Despite these data protection assurances, the complainant's data was passed on to another company within the Group and therefore to a third party. "It was assumed that customers of one Group company might also be interested in offers from the other Group company." This may be true, but it is inadmissible under data protection law. In accordance with the Federal Act on Data Protection (FADP), the principles of the Commission on Fair Trading stipulate that personal data may only be processed for the purpose that was stated when it was obtained, is evident from the circumstances or is provided for by law (principle no. 3.2 para. 3 lit. a). This was not the case, nor had the complainant consented to his data being used for any other purpose. Furthermore, there is no group privilege for the processing of data. It is unfair not to observe these provisions in the context of advertising measures. The complaint was therefore upheld.