How CEOs Can Navigate the Muddying Waters of Data Privacy Regulation.

The company that originally took possession of a consumer's data is still responsible, regardless of whom else the company shared that data with. Additionally, a given sensitive dataset may have originally been intended for a specific business need, but that dataset's usage may grow over time as business needs change, thus raising the risk profile of that dataset. [Extracted from the article]