Customer Database – What Influences Its Cost and What Are the Buyer’s Obligations in Poland?

Customer Database – What Influences Its Cost and What Are the Buyer’s Obligations in Poland?

Databases are readily used by entrepreneurs aiming to optimize marketing activities and improve sales results. Sometimes, companies use self-prepared databases. However, because the task of gathering data can be difficult and time-consuming, in most cases, obtaining a database from an external entity proves to be a better solution. The law provides for a number of ways to acquire a database. One of these is its purchase from the company that is the administrator of the collected data. In this article, we answer the question of what obligations fall on the entities involved in the transaction of selling a database of individual customers, and we also point out the factors that influence its cost. We encourage you to read the post below and expand your knowledge of operating with customer databases!

Do you have other questions about databases? Are you interested in purchasing a database of individual customers or a business database? Contact us.

Is Buying a Personal Data Database Legal?

The issue of acquiring databases is connected with the processing of data regulated in the General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. Neither the EU nor national provisions prohibit the sale of a database. Nevertheless, an entrepreneur who purchases a database must fulfill a number of legal obligations.

Customer Database – What Should the Buyer Pay Attention To?

Some of the obligations resting on the entrepreneur concern the verification of the counterparty. To gain the right to process data legally, the entrepreneur should ensure before purchasing that the data was collected legally and that the seller—the data administrator—has the right to process it. In the next step, the buyer should establish the scope of consent given by the customers. Sometimes, consent is given only for the benefit of the seller, and its content does not provide for the transfer of the right to process. In such a situation, the seller must contact the customers before the purchase and obtain separate consent for the sale and use of the data.

In which situations will purchasing a database not be a good solution for the entrepreneur? Firstly, when the seller has not obtained consent for the processing of data contained in the database. This kind of customer database is essentially commercially useless, as it cannot be used for marketing purposes. Secondly, in a situation where consent has indeed been obtained, but it turns out to be legally flawed (e.g., its content does not meet the requirements established by the regulations). In this case, too, using the data for business purposes is essentially ruled out.

Sale of Customer Databases – Buyer's Information Obligations

Article 14 of the GDPR Regulation specifies what information the database buyer must provide to the customers. According to Art. 14(1), if personal data has not been obtained from the data subject (which is the case when customer databases are sold), the administrator is obliged to provide these individuals with the following information:

• Their identity and contact details and, where applicable, the identity and contact details of their representative.
• Where applicable, the contact details of the data protection officer.
• The purposes of the processing for which the personal data are intended, and the legal basis for the processing.
• The categories of personal data concerned.
• Information on the recipients or categories of recipients of the personal data, if any.

Sale of Customer Databases – What Else is Worth Remembering?

As stated in Art. 14(2), the administrator is obliged to provide the individuals whose data is contained in the database with the following necessary information to ensure fair and transparent processing in relation to those individuals:

• The period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period.
• If processing is based on the legitimate interest of the administrator (Art. 6(1)(f)) – the legitimate interests pursued by the administrator or by a third party.
• Information about the right to request from the administrator access to the personal data, rectification, erasure, or restriction of processing, and the right to object to processing, as well as the right to data portability.
• Where processing is based on Art. 6(1)(a) or Art. 9(2)(a), information about the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Information about the right to lodge a complaint with a supervisory authority.
• The source of the personal data and, where applicable, whether it came from publicly accessible sources.
• Information about the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4), and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

How Much Does a Customer Database Cost? What Determines the Price of Individual Customer Databases?

Finally, let's consider the issue of database costs. The factors that influence their amount include:

• The number of records in the database – the unit price per record decreases as the overall number of records increases.
• The content of the records (i.e., the scope of data provided) – to reduce costs, it is worth deciding to purchase only the data necessary to achieve a specific goal and the chosen form of contact with the customer.
• The quality and up-to-dateness of the database.

It is important to remember that purchasing a database will not always be profitable for the entrepreneur. In many cases, obtaining data under a license granted by the administrator will be a good solution. The licensee does not become the owner of the database but can use it for the period stipulated in the agreement. Due to the lack of ownership transfer, a license agreement is more attractively priced than a database sales agreement.