In a ruling on October 4, 2024, the Court of Justice of the EU clarified that the resale of personal data may be permitted under specific conditions according to the GDPR. This ruling creates opportunities for companies that wish to use data commercially, but it also emphasizes the need for careful consideration and adherence to strict conditions.
The Court emphasizes that the resale of personal data is only allowed when there is a valid lawful basis, such as the legitimate interest of the data controller. It is important for companies to be transparent about how data is used and to respect the rights of data subjects. In some cases, explicit consent may even be necessary.
What does this mean for your organization?
✔️ Clear guidelines for commercial data processing: Companies can resell personal data, but only if they comply with the GDPR requirements.
✔️ Strict compliance required: It is essential to conduct a detailed risk analysis in advance and ensure a valid legal basis, such as legitimate interest or explicit consent.
✔️ Transparency and data subject rights: Data subjects must be well-informed about how their data is used, and their rights, such as the right to object to processing, must be safeguarded.
This ruling offers opportunities for companies looking to leverage data processing commercially, but it also underscores that diligence and adherence to the regulations remain essential. As experts in IT and privacy law, we are happy to assist you in setting up a compliant data policy and weighing legal risks.
Contact us for advice on data processing and your commercial strategy!
