Companies selling details

[Rainandsunny]

So I thought this breaches GDPR etc
A couple of times I’ve received a quote from a company re life insurance with my name, age.
This time I called the company to ask them who is selling them my details as I’ve never contacted this company so they could not have my details in the first place. They have also obviously been sold my address as the letter got to me.
They gave me the name of what seems to be a marketing company with whom I’ve left a message to call me back.
I’m guessing it would probably be my car insurance company that sold them details
Surely in all parts of this chain GDPR is breached?
How is this legal?
Thanks

In simple terms, it is legal provided you have consented to them processing your personal data and their privacy notice tells you that they will sell it to other companies. You have the right to tell them to stop processing your data.

Did you consent to details being sold on? Have you got a copy of a screenshot or form saying no?

Hi, I have no idea how the marketing company got my details.
I think I’ll also ring my car insurance company and ask if they passed details on.
I always ask to come out of marketing etc and ask for my details not to be passed on.
I renewed my car insurance by phone. Of course it could have been something else but I’m extremely careful with my details

@Rainandsunny

Hi, I have no idea how the marketing company got my details. I think I’ll also ring my car insurance company and ask if they passed details on. I always ask to come out of marketing etc and ask for my details not to be passed on. I renewed my car insurance by phone. Of course it could have been something else but I’m extremely careful with my details

So the marketing company can't tell you?

It's so frustrating isn't it.

Hi, yes the marketing company can’t tell me- they said they will send me a letter to say ‘which agent’ sold my details to them once they have looked into it.

One of the principles of GDPR is that organisations that hold your data are able to show they do so with your consent and where it came from. If they can't they are in breach.

However the only way to know is to ask them.

@ProfessorSlocombe

One of the principles of GDPR is that organisations that hold your data are able to show they do so with your consent and where it came from. If they can't they are in breach.

However the only way to know is to ask them.

I have to correct that.

In order to hold and process your data an organisation must have a lawful basis for processing. Consent is one basis but there are others - legitimate interests, contract, legal obligation and so on. If they rely on one of the others, they do not need to show that they have your consent.