Article 6 — Obligation of Third Parties Receiving Data at the Request of the User

Legal Provision

Obligation of third parties receiving data at the request of the user: establishes the obligation for third parties to use the data in accordance with the restrictions set by the data holder.

Scope

Applies to third parties.

Requirement type

Duty: when the data holder shares data with a third party, data must be processed under the conditions agreed and for the period necessary for the agreed purpose.

Actions to demonstrate compliance

A. Binary (yes/no): if these elements are present, there is evidence towards demonstrating compliance.

• Documented data sharing/recipient agreement.
• Existence of a contract between the data recipient and the user.
• Use of Model Contractual Term (MCT Annex IV).
• Documented data use policy (e.g., permitted and prohibited uses).

B. Non-binary (require a contextual assessment): building on the binary actions, a contextual assessment of these points is required in the context of the data recipient agreement.

• Adequate technical capabilities to enforce data restrictions (e.g., purpose-based access policy, logging monitoring and auditing…).
• Contractual agreement that makes data sharing fair and compliant with regulations (see elements below).

Monitoring requirement

• Monitoring of controlled use (verifying enforcement of restrictions).

Consequences of non-compliance

• Suspension of data transfer.
• Fine determined by Member State.
• Other type of contractual or liability claims.
• Unlawful competition claim.