this post was submitted on 14 Oct 2026
188 points (95.2% liked)
Technology
89137 readers
4944 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Marketing data is always kept close by the owners but they sell access or the data would be worthless.
If the original company wants information about you, they don't download everything from a marketing company. Like using Google, you type in your search and get a result. That search result is used and forgotten. You don't have to download all of Google to use the results.
The 3rd party wouldn't be fined because if you knew who they were, you could send them a Gdpr and they would respond. The problem is knowing who these companies are.
So your scenario is moot.
The starting point is that company A get my data, then sell them to company B that then share them for free back to company A.
If the original company want my informations, it need to ask me the informations (and only the ones needed for the transaction) declaring the use it will do of such informations.
If the original company "googled" my informations, use them to contact my or to try to sell me something, I can ask where they get them and the answer cannot be "we googled them around". That is why the GDPR ask for an explicit consent to share personal informations with third parties.
There are special cases, like a company need to share information with a payment gateway or to retain information for a longer period as dictated by some other laws, but generally a company, without an explicit permission, need ask only the information needed for the transaction and to keep the informations only the time it need to complete the transaction. And even with an explicit permission it can not keep the information for more that a given number of years (3 if I remember correctly) without asking for permission again with the default as "if I don't answer, my answer is no".
Your starting point is that I don't know who the third part is and I don't know my data were sold.
But te 3rd party would be fined if they were found with my data without being able to offer my persmission to have them when asked.
The GDPR state that any company must list all the 3rd parties it shares data with.