Third-Party Data Sharing: What It Is & Why It Matters

What it is

Third-party data sharing is the disclosure of personal information to organisations other than the one that originally collected it, for example to service providers, subcontractors or other parties involved in a matter. Sharing is sometimes necessary, but it expands the circle of those handling the information, which raises additional considerations.

Privacy frameworks generally expect that information is shared only where appropriate, consistently with the purpose for which it was collected and individuals' reasonable expectations. Sharing is not inherently wrong, but it should be deliberate and justified rather than casual.

Whether and how information may be shared depends on the applicable law and the circumstances. This explainer treats the topic generally, and any particular sharing arrangement should be assessed against current rules.

Key requirements

Sharing information responsibly generally involves:

• Sharing only where it is appropriate and consistent with the original purpose and expectations.
• Knowing who information is shared with and why.
• Taking steps so that recipients handle information appropriately, including through suitable arrangements.
• Being transparent about sharing practices, typically through a privacy policy.

The precise obligations depend on the law and the relationship between the parties. This explainer does not state fixed rules; specifics should be confirmed with current guidance such as the OAIC.

Why it matters for debt recovery

Recovery can involve other parties, such as the original creditor, service providers or subcontractors, so information sharing is often part of the work. Each point of sharing is a point of potential risk, which is why a client's privacy team will want to understand who else might handle its customers' information.

For a prospective client, a provider's discipline around sharing, including how it controls subcontractors, is a key part of assessing real exposure. A provider that shares carelessly or cannot account for who handles information is a meaningful risk.

Our Trust Centre covers related topics including cross-border transfer and data residency.

What to ask a provider

Useful questions include: With whom does the provider share debtor information, and why? How does it ensure recipients, including subcontractors, handle information appropriately? And is it transparent about its sharing practices?

Look for clear visibility and control over who handles information. A provider that can account for its sharing and impose appropriate expectations on recipients is managing this risk well.

How Merion approaches it

Merion follows the principle that information should be shared only where appropriate and consistent with the purpose for which it was collected. We aim to know who information is shared with and why, to expect recipients including any subcontractors to handle it appropriately, and to be transparent about our practices.

This is general information only and not legal advice, and it asserts no certification. Whether and how information may be shared depends on the law, so the OAIC and independent advice are the right sources for specifics.