A city shares resident email lists with a festival partner for joint promotions without clarifying roles or putting protective arrangements in place. What GDPR-aligned principle should guide that third-party sharing?
Select an answer to reveal the explanation.
Short Explanation
Handing over resident emails is not like lending a stapler. You need a lawful basis and clear deals about roles and protection before the list walks out the door. Good intentions and a vague ‘we’ll delete later’ are not enough.
Full Explanation
Disclosing personal data to another organisation is processing that requires a lawful basis and clarity on whether the recipient acts as controller, joint controller, or processor. Appropriate contractual and security arrangements should match that role allocation. Informal partner sharing without legal basis analysis or protective agreements conflicts with GDPR principles on lawfulness, purpose limitation, and security.