{"id":189700,"date":"2024-08-11T08:04:39","date_gmt":"2024-08-11T07:04:39","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=189700"},"modified":"2024-08-11T08:04:40","modified_gmt":"2024-08-11T07:04:40","slug":"collect-individuals-personal-information-third-party","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/collect-individuals-personal-information-third-party\/","title":{"rendered":"Can I Collect an Individual’s Personal Information From a Third Party?"},"content":{"rendered":"\n

The UK General Data Protection Regulation (UK GDPR<\/strong>) regime regulates the collection and use of personal data in the UK. Busy businesses increasingly rely on collecting certain personal information from third parties rather than directly from individuals. However, collecting personal data from third parties involves various legal rules under data protection law, which you should be aware of and comply with. This article explores some critical issues a data controller business should consider when collecting personal data from third parties.<\/p>\n\n\n\n

What are Common Examples of Collecting Data from Third Parties?<\/h2>\n\n\n\n

As a data controller, you may collect information directly from individuals. For example, asking your customers to sign up for your services online, and gathering their contact details and payment information via your e-commerce shop. <\/p>\n\n\n\n

Some businesses do not just collect all personal data directly from individuals. Instead, they may use third-party sources such as data brokers or credit agencies to gather personal data on their behalf. While this approach can be helpful, it also introduces complex legal considerations. <\/p>\n\n\n\n

\n

For example, purchasing marketing lists or acquiring customer information from partner organisations requires careful consideration and several vital steps to comply with strict data protection law rules.<\/p>\n<\/div>\n\n\n\n

What Key Issues Should You Consider When Collecting Data from Third Parties?<\/h2>\n\n\n\n

The UK GDPR sets out a comprehensive data protection framework that regulates the processing of personal data to ensure transparency, fairness, and lawfulness when using personal information. When you collect personal data from third parties, compliance with the UK GDPR<\/a> is crucial to protecting individuals’ rights and maintaining trust in your business.\u00a0<\/p>\n\n\n

\n \"Front\n
\n
GDPR Essentials Factsheet<\/div>\n
\n

This factsheet sets out how your business can become GDPR compliant.<\/p>\n <\/div>\n \n\nDownload Now<\/a> <\/section>\n <\/div>\n\n\n\n\n

This is particularly important when your company has yet to collect an individual’s details directly from them. <\/p>\n\n\n\n

Here are some key issues your business needs to consider when collecting personal data from third-party sources:<\/p>\n\n\n\n

The Right to Be Informed<\/h3>\n\n\n\n

The UK GDPR gives individuals the right to be informed. Data controllers must notify individuals about collecting their data from third-party sources. You need to provide essential information, such as details about the data’s source, the categories of personal data collected, and the purposes of processing. <\/p>\n\n\n\n

It is essential to inform individuals about your data collection process and the source of their personal data within a reasonable timeframe, typically by one month after obtaining the data. <\/p>\n\n\n\n

For example, if you purchase a marketing list from a third party, you must inform the individuals on that list about where their data came from, what types of data you hold (such as names and email addresses), and why you are using it.<\/p>\n\n\n\n

There are exceptions to this requirement, including situations where the individual already has the necessary information or where providing such information would involve a disproportionate effort. However, these exceptions require careful documentation and justification. You must also verify and demonstrate what information the individual has received, and relying solely on third-party assurances is insufficient.<\/p>\n\n\n\n

Due Diligence<\/h3>\n\n\n\n

Due diligence is vital for verifying that the fair and lawful collection of data you obtain via third parties. This means ensuring third-party providers collect data according to data protection law rules.\u00a0<\/p>\n\n\n\n

When collecting data from third-party providers or partners, you should request documentation and thorough information from them, such as details about who compiled the data, how it was collected, and whether a copy of the privacy<\/a> notice was issued to individuals. Additionally, you should confirm the data’s accuracy and whether it is up to date. <\/p>\n\n\n\n

A written contract with the relevant third party can help you confirm the reliability of the data they have collected and set out your rights to audit compliance with data protection laws. However, you remain responsible for ensuring compliance with the rules around gathering personal data through third parties. <\/p>\n\n\n\n

Determining the Lawful Basis for Processing Personal Data<\/h3>\n\n\n\n

When collecting personal data from third parties, determining the correct legal basis for processing is essential under the UK GDPR<\/a>. <\/p>\n\n\n\n

You should consider how the data was initially collected, for what purpose, and under which lawful basis. For example, suppose you seek to rely on legitimate interests to process personal data. In that case, you will need to perform a balancing test to ensure that your business needs do not override the rights and freedoms of individuals. This involves assessing the purpose of processing, its necessity, and any potential impact on individuals. <\/p>\n\n\n\n

Under the UK GDPR accountability principle, you must maintain records of consent and any assessments conducted using legitimate interests. <\/p>\n\n\n\n

If you buy or rent data lists, your business should ensure you obtain assurances that the data you have received has been collected in compliance with UK GDPR and any other relevant legal rules. <\/p>\n\n\n\n

Regardless of the legal basis\u2014whether consent, legitimate interests, or another\u2014you must verify that the data has been legally obtained and processed per data protection law rules.<\/p>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n

\n
\n Need legal advice?\n
\n \n Call 0808 196 8584<\/a> for urgent assistance.\n
\n Otherwise, complete this form, and we will contact you within one business day.\n <\/span>\n <\/div>\n\n \n\n
\n