Article 9(1) of the GDPR prohibits the processing of special category data (including health data) unless a specific condition in Article 9(2) applies. ‘Legitimate interests’ under Article 6 is not one of the available conditions for special category data. Therefore, it cannot be used as the legal basis for this type of processing. The company would need to rely on a condition from Article 9, such as explicit consent (Article 9(2)(a)) or processing for health purposes (Article 9(2)(h)), subject to safeguards.

The GDPR and the ePrivacy Directive (implemented nationally, e.g., in France’s Loi informatique et libertés) are complementary. The GDPR governs the lawful basis for *processing* personal data (the email address for marketing purposes). The ePrivacy rules govern the *method* of communication (sending the email). The company must first establish a GDPR lawful basis, such as consent or legitimate interests, for using the email address for marketing. Only then do the ePrivacy rules, which may allow a soft opt-in for existing customers, come into play for the act of sending.

It is crucial to distinguish between the right of access (Article 15) and the right to data portability (Article 20). For an access request, the controller must provide the information in a concise, transparent, and intelligible format—a PDF often suffices. The portability right is distinct and has stricter technical requirements: the data must be provided in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) to enable transmission to another controller. The company must verify which right the individual is exercising.

Article 33(1) of the GDPR states: “In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority…” The 72-hour deadline is the outer limit where feasible, but ‘without undue delay’ implies it should be done as soon as reasonably possible. There is no 24-hour rule in the GDPR standard text.

Article 27 of the GDPR requires controllers or processors not established in the Union (like a UK company post-Brexit) to designate in writing a representative in one of the Member States where the data subjects whose data is processed are located. The representative must be established in a Member State where the data subjects are. The exemption for occasional processing that is not large-scale or risky does not apply here, as processing for order fulfillment is a core, regular activity.

Article 28(2) and (4) of the GDPR are clear. A processor cannot engage another processor (a sub-processor) without the prior specific or general written authorization of the controller. Furthermore, the processor must inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object. A DPA being silent does not imply authorization; it means the required contractual governance is missing, putting the arrangement in violation of Article 28.

While processing special category data at scale is a criterion for requiring a DPIA (Article 35(3)(b)), the scenario that most strongly triggers the need for *prior consultation* under Article 36 is when the DPIA indicates that the processing would result in a **high risk** and the controller cannot mitigate that risk. Automated decision-making, including profiling, with legal or similarly significant effects (like being flagged for a medical screening which could lead to diagnosis or treatment changes) is a core high-risk activity listed in Article 35(3)(a). This would typically necessitate prior consultation if residual risk remains high.

The right of access is not absolute but must be balanced against the rights of others. The employer has an obligation to conduct a reasonable search for the employee’s personal data. However, they are not required to disclose emails that do not contain the employee’s personal data or are about other individuals. When providing the data, they may redact or withhold parts that would reveal another individual’s personal data (requiring a balance of rights) or genuine trade secrets/confidential business information, but they must be transparent about the fact that they have done so. Simply refusing or providing everything is not a compliant middle path.

The firm is acting as a controller for its own processing (creating profiles). The source of the data (public, third-party) does not exempt it from GDPR obligations. It must establish a lawful basis under Article 6 for its processing (legitimate interests for B2B marketing of its own service is a potential basis, but it requires an LIA). Crucially, under Articles 13 & 14, it has an obligation to provide privacy information to the data subjects. Since the data was not obtained from the subjects, it must provide the information under Article 14 (e.g., on its website) or find an exemption, which is difficult for this type of commercial profiling.

Article 9(1) of the GDPR prohibits the processing of special category data (including health data) unless a specific condition in Article 9(2) applies. ‘Legitimate interests’ under Article 6 is not one of the available conditions for special category data. Therefore, it cannot be used as the legal basis for this type of processing. The company would need to rely on a condition from Article 9, such as explicit consent (Article 9(2)(a)) or processing for health purposes (Article 9(2)(h)), subject to safeguards.0