GDPR help

[DivisionBelles]

Not sure if this is the best place to ask.

I work for a small company. Without outing myself, we sell a service. Another rival company also sells the same service. Later on this year we will be taking over the supply of this service from the rival company. I've been tasked with contacting former users of the service supplied by the rival company. We have gained this information to contact them from a middle man. I don't think we can use their contact information to get in touch without breaching GDPR. My boss is adamant that I must contact them but I'm not happy to do so. Who is correct? More importantly, how do I refuse without sounding awkward?

Sorry this is a bit vague, but hopefully it makes sense!

It depends how the middle man collected the details. It is not 100% clear from your post on what basis the details have been obtained. Do the customers know you will be the new service provider?

Some customers may know, but not sure all will and have no way of finding this out.

It might make it clearer if I am a bit more specific. We let holiday properties, the same as the rival company. One particular house is leaving the other company and coming to us. We have guest names and phone numbers obtained by the house owner and given to us and we want to be able to contact them and let them know they can book with us now.

Nothing underhand there so yes you can. You are legitimately in possession of the information and you have a legitimate interest in contacting these people to see if they want to buy your services. Contacting them does not harm their interests, rights or freedoms.

"We have guest names and phone numbers obtained by the house owner"

What does 'obtained by' mean? How did the house owner 'obtain' that information - was it freely given to them? Are you aware of whether any privacy notice/privacy policy was brought to the individuals' attention at the time they gave their personal details?

Before you use someone's personal data I would want to be sure that it was obtained lawfully, with appropriate privacy notice explaining how that data would be used, and I would want to satisfy myself that the use I was intending to make of that personal data fell within the various uses the individual was told at the time would be made of that data. If they were told it might be shared with third parties, used for marketing purposes, blah blah, that's one thing. But if they were told no such thing, I would want to steer clear. Their course of action could potentially be against the entity who shared their data (if adequate consent/notification wasn't given) and against the entity who used it.

If the rival company were the ones that gathered the information, then the house shouldn't be sharing this with you unless it is was clear that it would be passed on.

cause of action, not course of action, stupid autocorrect!

I work for a small company. Without outing myself, we sell a service. Another rival company also sells the same service. Later on this year we will be taking over the supply of this service from the rival company. I've been tasked with contacting former users of the service supplied by the rival company.

It sounds like you might be able to contact them under the Legitimate Interest condition. I would suggest you contact the ICO as you will find they are very helpful to verifying the legality of what you need to do.

Also if you are acquiring the service from this third party supplier, and they are providing you with the database of existing customers (who have already used the service) as part of the acquisition, then this could be relevant to Legitimate interest, as you are letting them know that you will be providing the service to them in the future.

ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/

... helpful to verify the legality of ....

How exactly will you contact them? Telephone is probably ok, but you may need to look more closely I you plan o use email/text.

For email/text you may need specific consent from the recipient to receipt of marketing material from you company. I doubt you have that.

Or you’d need to contact them electronically as agent of the ‘house’ owner who collected the details (not in the name of your own company).

If you just send them emails/texts from your company without proper consents you may be in breach of both PECR and GDPR, breaches of which can entail large fines for your company.

On the point above - legitimate interests will be your legal condition for telephone calls. For emails/sms you are only allowed to rely on specific, informed consent.

And if it call the ICO be sure to do it on a ‘no names’ basis so if they receive complaints from those you market to they can’t trace in their records that (for example) you were told by the Ico that you would be acting unlawfully.

Part of the acquisition of any business is the goodwill of existing and previous customers.

Did the owner only collect their names and phone numbers, or do they have addresses as well?

We would be contacting them by phone only. We don't have email addresses. The house owner obtained the names and phone numbers as they were passed onto them by the other company. The privacy policy of the other company does state that owners will get contact info but only for essential use, ie; emergencies happening at a house

”Part of the acquisition of any business is the goodwill of existing and previous customers.”

Doesn’t sound like there has been a business acquisition of any kind.

”The privacy policy of the other company does state that owners will get contact info but only for essential use, ie; emergencies happening at a house”

In that case as a previous guest who had been assured my telephone number would only be used by the owner for emergencies, I would be extremely unimpressed to find the owner had passed it on to a third party company for use for marketing purposes...

The owner is an individual, not a business. Are they bound by GDPR?

Yes because they are not processing the personal data in a personal capacity- it’s an economic activity.

And your company certainly is, and it sounds like you are fully aware this data was not given for the purposes of marketing and should not be used for such.

Exactly flowery. Hence my reluctance to make contact. It doesn't sit right and I feel uncomfortable doing it.

I would contact the ICO as suggested above. Explain what the data is and why it was given and ask for their view on whether a third party using it for marketing purposes would be in breach of the Data Protection Act 2018 (which enacted GDPR). They will say yes.

Once the ICO have advised you, tell your boss that, because randoms on the internet like us won’t be enough.

There could be fines involved, as well as some very irritated potential clients, so I can’t imagine the benefits outweigh the risks.

How about asking the previous house owner to contact their clients with your information? If you reimbursed them for a mailshot they could do it for you. It sounds like they are happy to send the business your way if they are willing to provide contact details. It would play a lot better with the clients than a random cold call from you.