0

I'm wondering if it is legal for individuals or companies to use phonebook data for commercial purposes, such as contacting people found on the phone book to sell them products or services, or even selling that data to companies as leads so that they can contact them to try and sell their products/services.

From a GDPR perspective, I lean to conclude that people would have had to give their consent for their phone number to be used by companies to contact them, right? But it seems hard to find what did people sign and consented to by accepting on being listed on phonebooks.

Improve this question
2
  • 1
    GDPR applies regardless of whether personal data was collected via public sources. This would however trigger notification requirements per Art 14. This might also affect a "legitimate interest" balancing test. The ePrivacy Directive Article 13 prohibits robocalls (without consent), and allows other marketing calls on an opt-in or opt-out basis depending on country. The UK picked the opt-out approach in PECR Reg 21 with the Telephone Preference Service, a do-not-call list. In contrast, Germany went opt-in for consumers and requires prior explicit consent for marketing calls in §7a UWG.
    – amon
    Commented Nov 13 at 6:56
  • @amon so it seems that it is legal in the UK from the PECR. I found this source that says that it is allowed to make marketing call if people are not on that do not call list: ico.org.uk/for-organisations/…
    – Michael
    Commented Nov 13 at 21:36

3 Answers 3

Reset to default
4

What’s the legal basis for processing the data?

Basically all GDPR issues need to start with this. Why are you doing this? Is that a legitimate use?

Whatever decisions on that the phone book company made are not relevant to your decisions on that.

There will be some use cases that are legitimate and some that aren’t. Cold marketing calls are likely on the illegitimate side.

Improve this answer
3

In many countries affected by the GDPR, there are national laws against cold calling (e.g. , §7 UWG with fines as high as €300,000).

But since you asked about the GDPR, the consent by the people listed in the phone book would cover only the phone book publisher and data processors listed in the terms, and only the purposes listed in the terms. You are not on that list, presumably, and neither is cold calling.

Improve this answer
2
  • Interesting, thank you. It therefore seems that beyond the GDPR, it is the national law of the specific country that dictates whether cold calling is legal or not. I just found this source for example claiming it is allowed in the UK as long as the individuals are not registered on a 'do not call' list. ico.org.uk/for-organisations/…
    – Michael
    Commented Nov 13 at 21:38
  • @Michael, GDPR might still ban the processing of the information by you, see the second paragraph.
    – o.m.
    Commented Nov 14 at 5:27
1

In the U.S., the GDPR does not apply, and in the context of the domestic telephone call, it is hard to see how it could even unintentionally. There is a specific laws regarding junk faxes and there is a Fair Trade Commission robocall regulation (and in some U.S. jurisdictions, attorney cold calls are prohibited as a matter of attorney professional ethics).

As an aside, the junk fax law is pretty much the only federal law which can only be enforced in state court and cannot be enforced in federal court.

Improve this answer
2
  • I don't think robocalls use published phone books.
    – Barmar
    Commented Nov 13 at 20:19
  • @barmar I have no idea.
    – ohwilleke
    Commented Nov 13 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .