Thread · 3 tweets · 21 May 2021

Question for EU privacy friends: in reading the following from the @CMAgovUK & @ICOnews report, they seem to hint at the idea that intra-company data sharing could be considered to be controller-to-controller. Is there precedent for that?

Surely enough in Art4(7), "‘controller’ means the natural or legal person, public authority, agency or other body." There's certainly a lot of stuff that could be an "other body" determining means and purposes, including treating Poodle Naps and Poodle Fetch as separate.

It looks like they're hinting at what could be an effective way to enforce purpose limitations against processing that is both unfair to users and anticompetitive. I'd love to hear if this has worked before!