enter image description here
Lets say I have a couple of friends who I have in my address book and of course they saved me in theirs. There might be the obvious information about me like my phone number and my email address but maybe even more, like my sex, birthday, second email address, work address, private address and so on, depending on how organized my friends are.

When one of my friends installs an app on his/her mobile phone that has permissions to read their contacts, that app (like Facebook/Whatsapp or Google/Apple itself) will most probably grab all the information it can get, upload it to their servers and might match it to other information. At least I have no way of controlling it.
Now some company has all the information about me (which I carefully protected) perfectly arranged and preformatted by my friend or collegue, without my consent. The person installing the app of course signed away their privacy rights but not mine!

So my question is: Who is responsible for this unauthorized exchange of my personal data [Update] in Germany? [/Update]

Do I have to sue my friend/collegue for adding me to their address book and giving it away so easily or is the company that grabs information to be held responsible?

I asked the same question on the Android forum but it was called off topic. I hope it's ok to ask the same question again here.

closed as off-topic by Xander, Jens Erat, Philipp, TildalWave, Iszi Jan 12 '15 at 18:27

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    It's the company that is illegally obtaining and processing your personal records. Your friend was lacking the security awareness, but I'm not aware of any country where it's a crime. – Danubian Sailor Jan 12 '15 at 14:20
  • "which I carefully protected" -- if telling it to your idiot friends can be considered careful protection ;-) – Steve Jessop Jan 12 '15 at 14:41
  • 4
    This question appears to be off-topic because it is requesting legal advice, which not only may vary from jurisdiction to jurisdiction but also from case to case, and so should be obtained from a qualified legal practitioner in the appropriate jurisdiction rather than from the Internet where the well-meaning and logical opinions you receive on the matter may leave you more ill-advised than if you hadn't asked at all. – Xander Jan 12 '15 at 14:58
  • 4
    @РСТȢѸФХѾЦЧШЩЪЫЬѢѤЮѦѪѨѬѠѺѮѰѲѴ This is why over-reaching statements like "It's the company that is illegally obtaining and processing your personal records" are materially incorrect. – Xander Jan 12 '15 at 15:42
  • 1
    If it's off topic here, where is it on-topic? – ShadSterling Jan 13 '15 at 4:13

It's not an unauthorised exchange unless you make your friends sign NDAs before giving them your contact details. Without that, there's an implicit authorisation for your friends to make reasonable use of the data you've given them, which includes uploading it to third-party websites. So it's your responsibility, for giving out data that you want to be held safe from disclosure without first getting an NDA in place. Treat your own confidential data in the same way as you would any other confidential data, and you won't have this problem.

  • 4
    This argument may not be valid in the context of EU data protection law! Third-party websites should not be processing personal data without consent of the data subject. – pjc50 Jan 12 '15 at 13:48
  • 1
    Yes, but "I have a friend called Bob whose phone number is xxx-xxx-xxxx" is my personal data as well as Bob's, and I can give consent for it to be processed. – Mike Scott Jan 12 '15 at 13:52
  • 3
    @MikeScott it probably depends on the jurisdiction - at least in EU, you can give the information "I have a friend called Bob whose phone number is xxx-xxx-xxxx" and your consent to some company, but according to EU data protection laws for most usages of this information they still need to obtain consent from Bob that they can use the information, no matter from where they got the information, even if the source person or company had full permission from Bob. – Peteris Jan 12 '15 at 14:19
  • 3
    No, your phone number is your personal data, Bob's phone number is Bob's personal data. – Danubian Sailor Jan 12 '15 at 14:21
  • 3
    @РСТȢѸФХѾЦЧШЩЪЫЬѢѤЮѦѪѨѬѠѺѮѰѲѴ While that may be true in your head, do you have any documented examples of courts of law agreeing with your position? – Xander Jan 12 '15 at 15:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.