Does a company need customer consent to license its operational data?

The short answer: three documents and one data question

A company does not need blanket customer consent to license every operational record, but it may need consent for some of them. The answer comes from three sets of documents and one question about the data itself, and counsel should review all four before anything is offered.

• Customer contracts. Master services agreements, order forms and data processing addenda define confidential information and customer data, and many limit their use to providing the service.
• Privacy notices and terms. What the company told people when it collected their information shapes what it can do with that information later.
• Employee and vendor notices. Internal email, chat and call records involve staff and suppliers as well as customers.
• Whose data it is. Records the company created about its own work differ sharply from records it holds for a client, consumer personal information, health information or financial customer information.

For a portfolio CFO, the practical point is that consent is rarely all or nothing. It is usually a scoping exercise: which systems, which years and which fields can go into a dataset without new permissions.

What the rules actually say

US law has no single consent rule for licensing business records. Promises the company made, sector privacy laws and state privacy statutes each cover part of the ground.

• Promises are enforceable. FTC staff have warned that it may be unfair or deceptive for a company to adopt more permissive data practices, such as sharing data with third parties or using it for AI training, and tell consumers only through a surreptitious, retroactive change to its terms or privacy policy (February 2024 staff post, not a rule).
• California. The CCPA statute requires notice at collection of the categories of personal information, the purposes and whether it is sold or shared, and limits use to what is reasonably necessary and proportionate. The Attorney General's CCPA overview explains which businesses the law covers and that consumers can opt out of the sale or sharing of their personal information.
• Health information. Under HHS guidance on HIPAA de-identification, health information de-identified through Expert Determination or the Safe Harbor method (removing 18 specified identifiers) is no longer protected health information under the Privacy Rule.
• Financial customer information. Financial institutions under the FTC's jurisdiction follow the Gramm-Leach-Bliley Act Privacy Rule, which calls for notices and opt-out rights before customer information is shared with certain nonaffiliated third parties.
• People in the EU. The GDPR can apply to organizations outside the EU that offer goods or services to, or monitor the behavior of, people in the EU, so a US company's records about EU individuals raise their own questions.

B2B confidentiality is mostly a matter of contract rather than statute. Look for clauses that restrict customer data to providing the service, define what counts as confidential information, and carve out aggregated or de-identified data.

How it applies in common situations

Project files are a common grey area. The page on customer implementation project records walks through which parts of a project archive a company typically owns.

Why client-owned records are excluded

Some companies hold large archives that are not really theirs. A contact center handles tickets for its clients' customers, an agency produces work for its clients, and an outsourced accounting firm keeps its clients' books. The company stores the records, but the client typically owns them, and licensing them without the client's consent is a red flag that SourceX screens out.

That exclusion can shrink a dataset sharply. The guide to which companies cannot license their data covers the pattern, and how much data a company needs helps judge whether what remains is still worth an inventory.

Disclosure and consent good practice

1. Map first. List each system, the years it covers and whose information it holds before deciding whether anyone needs to be asked.
2. Read the documents in force at collection. A privacy notice updated last year does not automatically reach records collected under an older version.
3. Do not rely on a quiet policy change. Where new permission is needed, ask for it plainly instead of amending terms retroactively.
4. Ask specific customers in writing when a contract requires consent, describing the use, the de-identification applied and the term.
5. Agree redaction and de-identification rules with SourceX before any work begins. Nothing is delivered without an executed agreement and the company's authorization.
6. Record board approval where your governance requires it; see board approval for a data license.

Questions to ask your counsel

• Which customer contracts restrict the use of customer data or confidential information, and do any carve out de-identified or aggregated data?
• What did our privacy notices say in each period covered by the records?
• Do any systems contain protected health information, financial customer information, children's data or information about people in the EU?
• Are we a covered business under the CCPA, and would a license count as selling or sharing personal information?
• Do any statements of work give clients ownership of the records we created for them?
• Who must approve a license under our governance documents and financing agreements?

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting, and remember that state privacy laws vary by state.

Next step

If a company in your network has years of its own operating records and a CFO who can work through these questions, check the baseline on who qualifies and register as a partner to make the introduction. The company can also apply directly at sourcex.si/apply.