A retailer buys prospect lists from a data broker and plans to delay any privacy information to those individuals indefinitely. Which statement best reflects Articles 12 and 14?
Select an answer to reveal the explanation.
Short Explanation
Buying a list does not buy you a free pass on telling people. When data did not come straight from the individual, Art. 14 still expects information within set timeframes—unless a narrow exception truly fits. "We bought it" is not an exception.
Full Explanation
Article 14 requires controllers to inform data subjects when personal data have not been obtained from the data subject, including identity, purposes, categories, sources, and rights, within specified time limits (for example, within a reasonable period, at first communication, or before disclosure to another recipient, and generally within one month). Limited exceptions exist, but purchase from a broker, NDAs, or assuming anonymity without meeting anonymisation standards do not create a blanket opt-out from notice.