If some data is shared with an external entity, it likely needs to be included in a few usual disclaimers, with at least a few meetings to clarify the exact wording and verification of the legal implications with the right dept and double check how it complies with others data protection rules, and don't forget the audit, and I think this contains a mistake so maybe let's investigate this issue first, and ...