gdpr
Is it allowed to collect additional personal data to comply with the information obligation (Article 14 GDPR)?
<p>True story. A bank erroneously sends its clients' data to a company: name, surname, national identification number. The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and is obliged to inform data subjects that they have obtained their data (Article 14 (2) b) and that they will want to destroy it, secure it or otherwise process it (Article 6 (1) letter f).</p>

<p>However, to inform the data subjects, the company would have to have their correspondence addresses. Because it has their national identification numbers, it can file a request to the appropriate national office, provide appropriate justification and obtain these addresses. Is it allowed, however?</p>

<p>Article 5 states:</p>

<blockquote>
  <p>Personal data shall be (...) adequate, relevant and <strong>limited to what is necessary</strong> in relation to the purposes for which they are processed</p>
</blockquote>

<p>Article 11 states:</p>

<blockquote>
  <p>If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, <strong>the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation</strong>.</p>
</blockquote>

<p>(I'm hoping the bank has fulfilled its obligations to report to the supervisory authority under Article 33.)</p>

<p>The Regulation left the door open for confusion by listing "erasure or destruction" as "processing" under Article 4 paragraph 2. In terms of deletion (or not "maintaining"), article 11 paragraph 1 (as quoted in the question) is the relevant part of 2016/679.</p>

<p>Compliance with <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&amp;from=EN" rel="nofollow noreferrer">the Regulation</a> would not be appropriate justification for obtaining additional information.</p>

<blockquote>
  <p>The company becomes a "third party" in accordance with GDPR (Article 4 point 10) and is obliged to inform data subjects that they have obtained their data (Article 14 (2) b) </p>
</blockquote>

<p><a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">Article 4</a> has no standalone meaning. Just because a definition matches, nothing happens just because of that. The definitions in Article 4 have only a meaning when they are used somewhere else in the GDPR. I found 3 places:</p>

<ul>
<li><a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6</a> (Lawfulness of processing)</li>
<li><a href="https://gdpr-info.eu/art-13-gdpr/" rel="nofollow noreferrer">Article 13</a> (Information to be provided where personal data are collected from the data subject)</li>
<li><a href="https://gdpr-info.eu/art-14-gdpr/" rel="nofollow noreferrer">Article 14</a> (Information to be provided where personal data have not been obtained from the data subject)</li>
</ul>

<p>All 3 are cases about "legitimate interests pursued by (...) a third party". This does not match the situation you describe, so the company is not a third party as defined in the GDPR. </p>

<p>But even if the company was a third party, the GDPR does not have any obligations for a third party. In particular <a href="https://gdpr-info.eu/art-14-gdpr/" rel="nofollow noreferrer">article 14</a> has only obligations to a controller. It contains text like "the controller shall provide". </p>

<hr>

<p>But that does not mean that the company has no obligations. It has obligations for a different reason.</p>

<p>The GDPR does apply to every processing of personal data. It is possible that processing is performed by different controllers. For example:</p>

<ul>
<li>The German company Siemens writes on its website that Joe Kaeser is its CEO. So Joe Kaeser is the data subject, Siemens is the controller.</li>
<li>The googlebot reads the siemens website, add data about Joe Kaeser to its index, and allows other to search for that. This is still the same data, but now google is the controller.</li>
<li>I have searched using google and found that information about Joe Kaeser. I store that information in a document on my computer. If the GDPR would apply, I would be the controller. However, as I am a natural person and process the data in the course of a purely personal or household activity, the GDPR does not apply to this data processing.</li>
</ul>

<p>In your example <strong>the company becomes the controller</strong> at the moment it obtains the data.</p>

<p>But article 14 would not apply in this case, because of Art. 14(5)(b) GDPR:</p>

<blockquote>
  <ol start="5">
  <li><p>Paragraphs 1 to 4 shall not apply where and insofar as: </p>
  
  <p>(b) the provision of such information proves impossible or would involve a disproportionate effort, (...) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing.</p></li>
  </ol>
</blockquote>

<p>Article 11 does not apply, because it starts with a condition which is not met in this case:</p>

<blockquote>
  <p>If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, (...)</p>
</blockquote>

<p>You also ask:</p>

<blockquote>
  <p>Because it has their national identification numbers, it can file a request to the appropriate national office, provide appropriate justification and obtain these addresses. Is it allowed, however?</p>
</blockquote>

<p>Different countries may differently implement <a href="https://gdpr-info.eu/art-87-gdpr/" rel="nofollow noreferrer">Article 87</a>, but for example in the country I live, processing of the national identification number is only allowed when it is explicitly written in a law. So filing that request would be strictly forbidden just because of that. </p>
