The rules
Is it legal to sell data when a data company changes hands?
Updated
When a company holding personal data is sold, the regulators say what the buyer takes on: California excludes a merger transfer from a sale on a condition, and the FTC and the ICO set the buyer's duties.
Describe the data company Tell us what the company holds and sells, and whether you want to license, sell or close. We reply with the route that fits and what a buyer will ask first.
The US: the seller's promises bind the buyer
In its RadioShack letter the FTC recommended that customer information be sold only to a buyer in substantially the same line of business, bound by the privacy policies in place when the data was collected.
California: a merger is not a sale, on a condition
California's definition of a sale excludes a transfer as an asset in a merger, acquisition or bankruptcy where the buyer takes control of the business, provided the information is used or shared consistently with the law; a buyer that materially changes the use must give prior notice.
The UK: the data is part of due diligence
The ICO's data sharing code says a buyer must consider data sharing as part of the due diligence it carries out, including why the data was first collected and its lawful basis for taking it. Its section on databases and lists treats the transfer of a list of individuals as data sharing whether or not money changes hands.
Source: The law on customer data when a data company is sold