CNIL, data acquired from a third party: the supplier must check compatibility and may set the limits by licence (CNIL, 'Ensuring the lawfulness of the data processing - In case of re-use of data', 7 June 2024, section on datasets acquired from a third party)
The CNIL puts the compatibility duty on the supplier of the data, which is the holder, and says a licence can limit reuse to keep the transfer compatible. So the licence terms (no re-identification, no onward sale, set purposes) are part of the holder's compliance.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Where the third party initially collected the data for other purposes (e.g. in the context of the provision of a service to data subjects), it is for the third party to ensure that the transmission of such data is for a purpose compatible with the purpose(s) which justified its collection. It will therefore have to carry out a "compatibility test". ... This license agreement can, for example, regulate this compatibility by limiting possible reuse.”
Where it was read
Also read from the same source
- CNIL, re-use of data: the compatibility test covers sharing with third parties (CNIL, 'Ensuring the lawfulness of the data processing - In case of re-use of data, carrying out the necessary additional tests and verifications', 7 June 2024 (courtesy translation))
- CNIL, re-use of data: even a compatible purpose needs a lawful basis and information to people (CNIL, 'Ensuring the lawfulness of the data processing - In case of re-use of data, carrying out the necessary additional tests and verifications', 7 June 2024 (courtesy translation))
- CNIL, re-use of data: the research presumption and why machine learning is not 'statistical' (CNIL, 'Ensuring the lawfulness of the data processing - In case of re-use of data', 7 June 2024 (courtesy translation))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide