Can I process the e-mails from my own e-mail account to make statistics?

Question

I'm working on a project for a company and I’m not sure if it's legal. I've made a system that automatically analyses my e-mail account and then displays statistics like:

-Most common senders
-Most common origin countries
-A heat map

I try to make statistics based on all malicious e-mail messages in my own personal e-mail account.

To make this possible I made a script in Python that extracts all e-mail headers from all e-mail in my mail account. I process:

e-mail names
e-mail addresses
IP-look-up information

On the IP-address in the header and some other basic information.

In the Netherlands we have a law (Wbp) what is based on 95/46/EG the Europa version. It feels like I’m not allowed to process personal information like name, country and e-mail address. But if this is not allowed why can we view this information on the e-mail clients? Then Gmail should violate the rules as well?

I use only information what Gmail/Outlook make available for me. I'm not asking for people to send me e-mail message they choose to send me those spam e-mails. Is it because they choose to send an e-mail to me I’m allowed to view/process there information?

I'm not allowed by the law to process personal informative that can trace back to the person. While I'm doing this by making a world map with a head map to get a feeling from which countries most e-mail comes. But to make this information I store the persons name, e-mail and country. But when having a Gmail/Outlook account I do basically the same without visualizing the data in a dashboard.

Does someone know if this is allowed in The Netherlands or in Europa? And if yes/no why? I have to defend this reason but ATM I’m not sure.

Answer 1

You most certainly can process names and email addresses. With further details, such as IP addresses, things are more tricky.

Let's have a look at some relevant parts of 95/46/EC:

'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

Now let's face the fact that, according to the definition of processing cited above, you start processing your senders' personal data immediately upon receiving mail from them: your email client collects, records, organises and stores it etc.

How does that fit into the law? I see no other way apart from that, by virtue of sending mail to you, the senders give their unambiguous consent:

Member States shall provide that personal data may be processed only if...

(a) the data subject has unambiguously given his consent; or...

'the data subject's consent' shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.

Indeed, it is common knowledge that, when one sends an email, the recipient will get the sender's name and email address, so it would be fair to assert that the sender gives their consent to process that data. However, only small percentage of people know that further details are transmitted as well, such as IP addresses (for the same reasons, the cookies law has emerged — as people are normally not aware how much personal information they transmit to websites when they simply visit them). Those details (unlike name and email address) are not normally processed by email software in such a way that is apparent to users — which is exactly the reason why most people would not expect those details to be processed and therefore, it would be reasonable to assert that they do not give consent for it to be processed.

To avoid doubt, the fact that you further process names and addresses that you already have got — with your Python scripts (on top of existing mail software processing) is not legally any different from not doing it — as noted above, the data is already processed anyway with the senders' consent.