GDPR Potential breach

[Charlie B ACS]

Apologies for the slightly convoluted explanation, but can anyone help me with this.


I contracted (as a Consumer) with company A for a Service.


I had given consent to Company A to send me marketing emails, but not to share with Third Parties.


Company A decided to sell that part of its business to company B, and novated the contract to them. They sent a letter informing me of this, with a line about company B’s privacy policy.


Company B have started sending me Marketing emails about their other services.


Whilst I completely accept that Company B should email me with regard to the contract, I don’t believe that the consent given to Company A for Marketing, can be given my them to Company B, without my express consent.


To make it worse, in the Marketing email sent by B, they include the first line of the address in the body of the email, and the 2nd half of my Postcode in the footer, to show “Its genuine”. The security question they ask to verify you when you call them, first line of address & postcode! I also think this could be in contravention of GDPR


Can anyone clarify if they have breached GDPR on either count?


Thanks

 

[dotcomdude]

When Company A obtained marketing consent from you, they should have specified who they would share those details with. If Company B wasn't on this list then I'd suggest you have a case...

 

[Charlie B ACS]

Thanks, what about putting personal details, which they use as security checks in a marketing email.

 

[Nord20]

I may be completely wrong here (I am not a lawyer), but I don't think you have a case.

With regards the info in the emails - they are sharing your data with you. What breach is there? I agree it's not a sensible idea, as the potential for the wrong email to go out to the wrong person would indeed cause them a serious data breach, but what actually happened is no different to when you order something online and get send a receipt email, which may include your billing/shipping address in its entirety.

As for Company B....they bought Company A, and all their assets, which includes your data. It would send serious shockwaves through the world of business if suddenly buying a business meant you couldn't actually use any of the customer data you just bought.

This article covers it quite well:

https://www.lexology.com/library/detail.aspx?g=e8f9d7f1-146d-4830-b3ea-07d9020a330b

 

[Charlie B ACS]

Company A's structure is convoluted, but I cannot see that they have sold any Limited Company to Company B, just novated contracts, and transferred employees by TUPE.

After the transfer I had two companies sending Marketing emails to me, as I am still a customer of Company A, in another part of their business.