How to Determine If a Third Party is the Source of Personal Information
What is the "source" of personal information?
The source of personal information is the person or entity from which your business collected the data. The consumer is the most common source of personal information. For example:
- When a consumer adds their email address to a newsletter signup, or enters their payment information to buy a product, the consumer is the source of information.
- When your business collects information passively about a consumer, such as collecting IP address or tracking the website links the consumer clicked on, the consumer is the source of information.
- When a service provider collects information from consumers on your business's behalf, the consumer is the source of information. For example, an e-commerce platform (e.g., Shopify) tracks a consumer's purchase history. Even if your business uses its e-commerce platform to view a consumer's purchase history, the consumer is the source of that information.
When is a third party the source of information?
A third party is the source of personal information when your business collects information from that party and that party did not collect the information from the consumer on your business's behalf. A few examples are described below.
Data Analytics Providers
Some data analytics providers merely collect or store data provided by your business or its customers. Others take that data and enrich it with data they've collected from other sources, or analyze sets of data to make inferences from it. In the latter cases, the data analytics provider may be the source of the enriched/analyzed data. For example, if a data analytics provider analyzes customer data, like geographic location, products purchased, and age, and makes inferences about what products or services a particular customer might be interested in, the source of geographic location, purchases, and age would be the consumer, but the source of the inferences would be the data analytics provider.
Data Brokers
If your business purchases data from a data broker, the data broker is the source of the information purchased. That is because the data broker did not collect the information on your business's behalf. It collected the information to sell it to any business that will buy it.
Government Entities
If your business purchases or otherwise collects non-public information about consumers from a government entity, the government entity is the source of that information.
Other Consumers
If your business collects non-public information about consumers from other consumers, those other consumers are the source of the information collected. For example, if an existing customer of your business refers another consumer to your business as a prospective customer and provides their contact information, the existing customer is the source of the prospective customer's contact information.