A retailer builds profiles from purchased marketing lists and never tells customers which categories of data came from those third parties. What indirect-collection rule is it missing?
Select an answer to reveal the explanation.
Short Explanation
When data arrive from somewhere else, the person still deserves a map of what was collected and where it came from. Hiding that the profile grew from a bought list leaves them in the dark. Tell them the categories and the source—unless a real exception applies.
Full Explanation
Where personal data have not been obtained from the data subject, Article 14 requires the controller to provide information including the categories of personal data and the source of the data, subject to limited exceptions. Vendor policies do not automatically discharge the controller’s own information duties. Indirect collection is not a blanket exemption from transparency, and the duty is not limited to automated decision-making scenarios.