The Usual Others

Third-Party Data in Contracts

The formation and performance of contracts between private individuals often involve not only personal data of the two contracting parties themselves, but also of a third person outside the contract. Such a third party may not have consented to the processing of his or her data. This article identifies valid grounds under the GDPR for using „third-party data“ and summarizes the findings in a two-step test for assessing such constellations.