5

How should a list of phone numbers be treated with respect to the GDPR? Assume each number is a personal number and will go to an individual, but that there is no other information stored related to the individual.

  • 1
    Your question lacks information on the context of the list. In a company, private? Where do this data come frome? What is the sense of such a list without any names? – K-HB Mar 16 at 13:22
3

Caution: I am not a lawyer.

It depends on who is doing the collecting and storing.

If it is done "by a natural person in the course of a purely personal or household activity", then it is exempt from the GDPR, as per Art. 2.

Beware, however, that "purely personal activity" means that you do not share or publish them. In this court case, having the name or phone number of someone else on your "personal" website constitutes "processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of Directive 95/46".

  • This presumes that phone number alone is personal data and you do not say why. – Greendrake Mar 16 at 17:46
  • 2
    @Greendrake As I showed in my answer: it is because it can be used to indirectly identify a person – Trish Mar 16 at 18:11
  • A phone number alone not necessarily can be used to identify a person. You may be lucky to find the owner's name in Yellow Pages, or google it, or obtain a court order for the telco to disclose it if they have it. But if the number belongs to a prepaid SIM card, identifying the owner can be very tricky in which case it won't be personal data. – Greendrake Mar 16 at 18:26
  • 1
    @Greendrake if it could be personal data, you have to treat it as if it is. – Trish Mar 16 at 19:09
  • 1
    Yes you can do that but, given the cost and amount of time required, I am fairly certain no EU court would see that as "means reasonably likely to be used" as per Recital 26. That's well beyond the threshold to consider such a phone number personal data. – Greendrake Mar 17 at 11:18
2

Under the GDPR, phone numbers are just as personal information as is the name or adress (emphasis mine):

For example, the telephone, credit card or personnel number of a person, account data, number plate, appearance, customer number or address are all personal data.

[...]

Last but not least, the law states that the information for a personnel reference must refer to a natural person. In other words, data protection does not apply to information about legal entities such as corporations, foundations and institutions. For natural persons, on the other hand, protection begins and is extinguished with legal capacity. Basically, a person obtains this capacity with his birth, and loses it upon his death. Data must therefore be assignable to identified or identifiable living persons to be considered personal.


For the purposes of this Regulation:

(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Argumentation I

Remember that phone numbers in the landline network contain location data (like the city of Kiel is +49-431-#, the city of Neumünster +49-4321-#). Cellphone numbers in the EU are provider coded (for example +49-176-# is Telefonica Germany), which can be used to identify an economic group from the average cost of the provider. Atop that, phone numbers are unique, making them by definition some kind of identification number, which is explicitly listed as automatically personal data.

Then, calling the number will most likely have the person talk, which allows identifying if one is talking to a male or female, some age estimate and maybe even the name. Or just enter a cellphone number in What'sApp and if they show up you might have even a picture.

By these virtues, a phone number can be used to indirectly identify a person, making a telephone number always personal data.

Without permission by the owner of the number you may not process it digitally in any capacity and even less sell it. Listing it somewhere (internet, book) where the public can access it, is clearly processing (and making it available for processing by others).

Under GDPR one needs explicit permission for processing, so yes, phone books need your permission to list your phone number.

Argumentation II

There is ECLI:EU:C:2016:779, in which a German court had requested clarification and the European Court decided that, if an IP address can be (sometimes together with a timestamp) used to identify that a specific person had this one at the given time, and this information is stored for proper billing, this information has to be personal data in the hands of the ISP. The court argues further that, since it is possible and legally possible for others to connect the IP with a person if they can get the ISP to do it for them (for example by having the police request such as they investigate a case), the IP is personal data even for these others. So, an IP is personal data to anyone that they have any legal means (for example by filing suit against Anonymous with IP ##) that could result in identification.

A telephone number is very much akin to a non-changing IP in that the Telephone provider is easily able to tell who has this number and has to do so for means of proper billing. As one could sue against Anonymus with Phone number ## (and have police investigate and fill the gap), a telephone number must be personal data, just like an IP.


more references (emphasis mine):

Could this number linked to a single person? [...]

Then yes. [...]

If you only have phone numbers without further information about them, you have to assume it is PII, because you don't know if a number belongs to an individual or not.

Any information these data controllers have on you, such as your date of birth, address, phone number, salary, and rent would therefore all constitute protected personal data under the GDPR.

CLASSICAL PERSONAL DATA

PHONE NUMBER

Your ID card, your phone number, your bank account, and your credit card number represent data that is unique to each person, therefore will lead to identification.

A brief guide what is (or could) be Personal Data

  • Biographical information or current living situation, including dates of birth, Social Security numbers, phone numbers and email addresses.

Examples of personal data

  • an Internet Protocol (IP) address;
  • the advertising identifier of your phone;
  • How can you identify a person by their phone number alone? – Greendrake Mar 16 at 17:44
  • @Greendrake that is not relevant. it is personal info as defined in the GDPR. and you could call it - which btw. can be illegal as unsocialized marketing in most of the EU. – Trish Mar 16 at 17:47
  • 1
    Right relevant. Why is it personal info if the person is neither identified nor easily identifiable? You can call it and what? – Greendrake Mar 16 at 17:53
  • 2
    @Trish, you can refer to C‑582/14 where the CJEU has determined that dynamic IP addresses are personal data (in Germany) even if only the internet provider has the data to identify someone. See paragraphs 40, 45-48. The same reasoning can be applied for phone numbers. Even if only the telephone company can identify the owner of a phone number. It does not matter how restrictive it is to get that phone number, if it is possible by law to get it, it constitutes a ‘reasonable means'. (A-G paragraph 73 C‑582/14) – wimh Mar 16 at 20:58
  • 1
    @wimh great resource, I think it is a different argumentative path, but a good one - that hits in a similar notch than my other one – Trish Mar 16 at 22:02
2
+50

The current question does not contain enough information to properly answer it.

  • I agree with Trish that a phone number is personal data. That is also expressed in the question.
  • And there are situations where the GDPR does not apply, like a purely personal activity, as noted by danuker.

But it is important to know which phone numbers are on the list.

  • If the list contains all existing phonenumbers in a country (like all numbers from 000000000 till 999999999), there is no problem at all processing it. Processing can be based on legitimate interests of the controller, and because the list contains all phonenumbers, it will not be overridden by the fundamental rights and freedoms of the data subjects. (Such a list expresses nothing special about an individual).

  • However if for example the list contains all phonenumbers of persons who donated to a particular church, Art. 9 applies, which is very restricted.

Most lists will probably be somewhere between those two extremes.

If the phone numbers on list are by definition not personal data, the GDPR would not apply. This could, for example, be the case if you compile a list of phone numbers used by telemarketing companies. But a phone number which is owned by a company, could still be personal data if it is used as a direct dial number of an individual.

  • If you think the question as it now is cannot be answered properly, does this mean, in your opinion, that all answers given here, including yours, are improper? – Greendrake Mar 17 at 0:03
  • @wimh I can't follow from "one processes all phone numbers in a country" to "it's in the legitimate interests of the processor". I think processing all numbers is irrelevant; it only matters whether the controller's interests trump the person's fundamental right to privacy. Can you find a legal reference about "all X in a country"? – danuker Mar 17 at 8:57
  • @Greendrake I think one can answer a general question if one addresses the various cases that apply. So far, wimh's answer is the most complete. – danuker Mar 17 at 8:59
  • 1
    @danuker What I mean is, when there is a list containing the numbers from 000000000 till 999999999, and my phone number is in that list, there is no privacy issue for me. That list expresses nothing special about me. So the controller's interests will always trump the person's fundamental right to privacy. I first thought that the GDPR would not apply to a list from 000000000 till 999999999, but knowing they are phone numbers, makes it personal data, and I could not find any exception which would apply. (A similar case is google maps which contain all addresses in a city, including mine) – wimh Mar 17 at 9:44
  • 1
    @danuker I agree with Trish that if data could be personal data, you have to treat it as such. And because of the data minimisation requirement, but also Art. 11(1): the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject [...], you do not need to know which phone number is personal data and which not. And it does not really matter whether a list of possible phone numbers is personal data or not, because even if it is, processing is possible based on the legitimate interests. – wimh Mar 17 at 10:15
2

If you don't have any information other than the telephone numbers, in your hands (being a data controller):

  1. you can't identify any living person from the telephone numbers alone, and
  2. you're not going to get any any further information related to the phone numbers that allows you to identify a living person,

the starting point is that it's not personal data.

But then if you were to start calling the owners of the numbers and asking them their names and associating that name with the telephone number, it would be.

See Recital 26 of the GDPR, third and fourth sentence.

  • Recital 26: See C‑582/14 paragraph 41: The use by the EU legislature of the word ‘indirectly’ suggests that, in order to treat information as personal data, it is not necessary that that information alone allows the data subject to be identified. Paragraph 43: In so far as that recital refers to the means likely reasonably to be used by both the controller and by ‘any other person’, its wording suggests that, for information to be treated as ‘personal data’ [...], it is not required that all the information enabling the identification of the data subject must be in the hands of one person. – wimh Mar 18 at 21:57
0

TL; DR

Phone numbers that are personal data should be treated as such. Phone numbers that are not personal data (and there will be these, even if they go to an individual) do not need to be treated as personal data.

Is an individual's phone number alone personal data?

Regardless of how many sources tell you that a phone number is always personal data, should you be taken to the court the decision will be based on the GDPR definition and any relevant case law. The definition goes:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier...

So, you have a phone number that goes to an individual. You do not know who he/she is yet. Can you identify?:

To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.

Your options are:

  1. Search on the web, Yellow Pages etc. This may work.
  2. Call the number and ask. This may work too depending on whether the phone is picked up by the owner and whether they are in the mood.
  3. Ask the telco provider to reveal the identity of the owner. This will almost certainly not work.
  4. Apply for a court order to get the telco provider reveal the identity. This will work if you win and the telco provider actually has the owner's details.

Now, in some countries it is possible to buy prepaid SIM cards without providing any IDs. This means that phone numbers the owners of which cannot be identified by reasonable means (i.e. without hiring detectives/intelligent services etc.) do exist.

And so what?

For each number, unless you are sure the owner cannot be identified by reasonable means, treat it as personal data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.