A city shares resident email lists with a festival partner for joint promotions without clarifying roles or putting protective arrangements in place. What GDPR-aligned principle should guide that third-party sharing?
Select an answer to reveal the explanation.
Short Explanation
Handing over resident emails is not like lending a stapler. You need a lawful basis and clear deals about roles and protection before the list walks out the door. Good intentions and a vague ‘we’ll delete later’ are not enough.
Full Explanation
Sharing personal data with third parties requires a lawful basis plus appropriate agreements and controls reflecting each party’s role. A city that shares resident email lists with a festival partner for joint promotions without clarifying roles or protective arrangements violates lawfulness, purpose limitation, and security discipline. Email lists may not be shared freely with any local partner merely because festivals feel like a public task. Collection by the city does not authorise redistribution without further legal analysis. A partner’s vague promise to delete someday is not documentation enough. Exam caveat: disclosure is processing—basis + role clarity + safeguards. Operational check: before any festival list share, record the lawful basis, decide controller/joint/processor roles, sign matching terms, and minimise fields to what the promotion truly needs. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.