A retailer buys prospect lists from a data broker and plans to delay any privacy information to those individuals indefinitely. Which statement best reflects Articles 12 and 14?
Select an answer to reveal the explanation.
Short Explanation
Buying a list does not buy you a free pass on telling people. When data did not come straight from the individual, Art. 14 still expects information within set timeframes—unless a narrow exception truly fits. "We bought it" is not an exception.
Full Explanation
Article 14 applies when personal data have not been obtained from the data subject—including purchased prospect lists. Controllers must provide required information within the GDPR’s timing rules (including the one-month benchmark and rules tied to first communication or disclosure), subject to limited exceptions such as disproportionate effort in defined circumstances, legal secrecy, or where the individual already has the information. Indefinite silence after buying broker lists is not a compliance strategy. Civic outreach teams and retailers using acquired contact data remain accountable for transparency to the people listed.
Article 14 does not vanish because data were purchased. Broker-sourced records are not automatically anonymous; if individuals are identifiable, GDPR duties continue. NDAs between broker and buyer may protect commercial secrets inter se, but they do not cancel data-subject information rights or allow endless delay.
Exam caveat: know the Article 14(5) exceptions at a high level and that “disproportionate effort” is narrow and must be documented with safeguards such as public notice where appropriate—not used as a blanket excuse for marketing lists. First contact often triggers notice obligations even if acquisition was earlier.
Operational check: on list intake, schedule Article 14 notices, suppress contacts that cannot be lawfully informed or contacted, record any exception analysis, and align the first campaign email’s footer and notice links with the Article 14 content actually due.