The agreement between two companies to exchange customer data to offer their products or services involves a transfer of data between them.
Who does not dream of befriending a company or a professional with thousands of customers or subscribers, and to agree to an exchange of offers to customers of the other ones, we make a cross-selling campaign with someone who has many more prospects you?
Basically, the agreement between two companies or professionals to exchange data of their customers to offer their products or services, each other’s customers, is a transfer of data between them, or to each other, if one only he is going to campaign other customers. As I have said on other occasions, the data transfer requires the authorization or consent of the owner of the data, even if it is only the name and email. The transfer of data is any disclosure of information made to a person other than the person concerned, and the demand that is specifically authorized or condoned by him is one of the principles basic system of data protection, and is enshrined in the arts. 11 and 27 of the Data Protection Act, and Art. 10 of the Regulation.
In addition, the consent must be prior, so not worth that we ask then, after making the transfer of data, and it is mandatory that the purpose of the transfer is the purposes directly related to the functions both legitimate as the yields of the recipient.
The authorization must therefore specify who are going to give data (even something generic such as “companies in the software industry with the responsible has business relationships”), and what will be yield (for example, “to report on commercial offers of interest”).
Needless to say, that for testing purposes, but not required that the authorization is in writing, it is essential to demonstrate its existence if necessary.
So, you know, if you go to reach agreements with other professionals or entrepreneurs to databases and to cross-sell, no problem, but you must take into account these aspects of the Act on Data Protection, if not you want to have the most expensive campaign in your history fines the Data Protection Agency.