An entity shares personal information with third parties without authorisation.
Consent buried in lengthy terms and conditions — particularly when it is not clearly brought to a person's attention — is not meaningful consent under data protection principles. Such principles require that consent be specific, informed, and freely given. A blanket clause in fine print authorising unlimited data sharing with unnamed 'partners' does not meet this standard. The sophistication of the legal document does not excuse the violation of the consent principle.
After you respond, they may push back with these arguments. Members get the full rebuttal for each.