A retailer builds profiles from purchased marketing lists and never tells customers which categories of data came from those third parties. What indirect-collection rule is it missing?
Select an answer to reveal the explanation.
Short Explanation
When data arrive from somewhere else, the person still deserves a map of what was collected and where it came from. Hiding that the profile grew from a bought list leaves them in the dark. Tell them the categories and the source—unless a real exception applies.
Full Explanation
For personal data not obtained from the data subject, Article 14 requires information including the categories of personal data concerned and from which source the personal data originate, and if applicable whether it came from publicly accessible sources—subject to limited exceptions. A retailer building profiles from purchased marketing lists without telling people about those third-party categories and sources misses the indirect-collection rule. Fair civic and commercial outreach depends on people knowing they were not only “customers” but list subjects.
Vendor privacy policies do not automatically cancel the retailer’s Article 14 duty. Source disclosure is not limited to automated decision-making contexts. Third-party sourced data are not exempt merely because the individual never visited the site—that is often exactly when Article 14 matters most.
Exam caveat: timing rules and Article 14(5) exceptions can apply, but “we bought a list” is not itself an exception. Categories and source types should be meaningful (e.g., broker prospect lists, public registers).
Operational check: on list ingestion, populate notice content with categories/sources, schedule Article 14 messages, suppress unusable contacts, and document any exception with reasons and compensating publicity.