According to GDPR, in case 1 they can transfer the data to the acquiring entity only if they are GDPR compliant too, and in case 2 all data sharing must be opt-in, not opt-out, so they can’t increase the scope of sharing without notice and affirmative consent.