Is this a GDPR Breach?

trfc20222

Hi all,

I was just wondering if someone could offer some advice

Where I work we run a series of conferences, one of these we licence out to a third party on our behalf- we own the data for anyone who attends etc but its licensed to them.

As part of this anyone who signs up for the event can tick a box to receive further information from us including info on our business and other conferences we run

Yesterday I discovered that they have disabled the API and withheld the data for those who have signed up to receive further information for over 6 months and are refusing to give us this information on who has signed up unless they get another contract with us. Based on previous years this would be about 3000 people.

Obviously from a contract perspective its a breach and we will not be agreeing a new contract with them but I wanted to know if it was a GDPR breach as well that we needed to report the company concerned in the sense that people have signed up to receive information from us and they are blocking that from happening

Thanks for the help

MattMattMattUK

trfc20222 said:

Hi all,

I was just wondering if someone could offer some advice

Where I work we run a series of conferences, one of these we licence out to a third party on our behalf- we own the data for anyone who attends etc but its licensed to them.

As part of this anyone who signs up for the event can tick a box to receive further information from us including info on our business and other conferences we run

Yesterday I discovered that they have disabled the API and withheld the data for those who have signed up to receive further information for over 6 months and are refusing to give us this information on who has signed up unless they get another contract with us. Based on previous years this would be about 3000 people.

Obviously from a contract perspective its a breach and we will not be agreeing a new contract with them but I wanted to know if it was a GDPR breach as well that we needed to report the company concerned in the sense that people have signed up to receive information from us and they are blocking that from happening

Thanks for the help

Withholding the data from you has nothing to do with GDPR. End users having ticked a box to be added to a mailing list and then not being added has nothing to do with GDPR. Anyone who has data controller responsibilities should know that so it is slightly worrying from your businesses side and indicates a lack of understanding of GDPR which should be something a business collecting large amounts of data on individuals understands. 

Refusing to hand over data as per the contract is a breach of contract and need to be dealt with through legal channels, refusing to hand over the contractually obliged data without your business agreeing to sign a contract extension is extortion and would be looked upon very dimly by the courts. Get a solicitor to send a letter before action to them, if that fails take them to court.