any person or legal entity receiving PI of a data subject other than the data subject itself or the controller or the processor