GDPR Legislation and user invites by email

Question

I want to understand what the implications are for user emails with the onset of GDPR.

It's a bit of a strange question but here is the scenario.

We run a Software as a Service platform when a user can invite other users to a team. They do this by email, at which point we have a user's "personal information" in the form of their email and we have issued them an email invite. We have to keep the email address on record for a period of time, say 7 days, for that invite to be accepted at which point we delete it if no action has been taken.

I understand the restrictions on me in terms of not marketing to this email address etc. I want to understand if I am even allowed to send the invite email in the first place. That is to say, if someone hasn't explicitly given me their email address, am I allowed to use it.

Logic would indicate that this should be fine as it really makes the user experience of inviting people very poor, however, the question has been asked by a member of my team and so I thought I'd seek some clarity.

Answer 1

I'm not entirely sure why you have to store the data of the invited user? You can simply hash the email address. Hashes are meaningless without the original input so that would allow you to store the data.

Sending email means that you're processing personal data. In your use case it would fall under Art 6 (f): Legitimate Interest.

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

I do advice you to also follow these guidelines in the submission of the email: https://sendgrid.com/docs/Classroom/Deliver/Address_Lists/peer_initiated_email_invitation_requirements.html