Merger or acquisition? Here’s how to ensure a bulletproof GDPR approach
Blog
25 February 2025
Data shared without consent: what went wrong?
A major media company, following the establishment of a new joint venture, transferred the personal data of users from its job platform to this joint venture. One of the platform’s users, whose data had been transferred, claimed that he had not given consent and that the processing was therefore unlawful.
What did the DPA decide?
The DPA ruled that the transfer of personal data to the joint venture constitutes a separate processing under the GDPR, even though the original media company holds a majority stake in the joint venture.
Although the DPA acknowledged that legitimate interest could be a valid basis for the transfer, it criticized two major shortcomings:
- The media company had not conducted a thorough balancing test in advance, and
- The transparency and information obligations had not been sufficiently met.
For these violations, the DPA issued two reprimands. Additionally, the company must organize active communication within four months to inform all existing users about the transfer of their data.
Avoid GDPR risks in business transactions: what you need to know
- The transfer of personal data in a business transaction is a separate processing that requires its own legal basis;
- The balancing test under Article 6.1(f) GDPR must be conducted and documented in advance;
- Data subjects must be actively and preemptively informed about the transfer of their data.
Are you facing a merger, acquisition, or joint venture?
If you are facing a merger, acquisition, or joint venture, it is essential to conduct a thorough privacy due diligence as part of your due diligence process. This should include an assessment of data transfers, the balancing test, and transparency regarding the intended transfer.
When complying with GDPR obligations, you can rely on our expertise:
Do you have questions about the privacy aspects of a joint venture or other types of business transactions?
Do not hesitate to contact us. Our experts have the necessary knowledge to help you properly structure your transaction and comply with all GDPR obligations.
Get in touch with our experts today, and we will be happy to assist you.
