The Personal Data Protection Board has published a Principle Decision on the personal data of third parties illegally sent by data subjects to data controllers upon the latter’s request, such as phone numbers and e-mail addresses. According to the Principle Decision, the data controller is under an active duty of care to ensure that the personal data provided by the data subjects is accurate and up to date. Therefore, data controllers must take technical and administrative measures to comply with active duty of care.
