According to GDPR, do I need a contract for processing on behalf with my e-mail provider?

Question

It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster.

Now, I am wondering whether the same is true for the e-mail provider that provides the e-mail address that serves as the official contact address for a website. Do I need a contract for processing on behalf with my e-mail provider, if they host the address that might receive inquiries from strangers who have visited my website?

My straightforward guess would be that my e-mail inbox can contain more personal data about people who visited my website by orders of magnitude than a server log that just stores IP addresses ever will.

On the other hand, I notice that at least e-mail providers here in Germany do not seem to offer any templates for such contracts (unlike various local web hosters). Furthermore, the only really explicit statement on the matter that I could find appears to come from one such e-mail provider, GMX, saying:

Bei GMX-TopMail handelt es sich um einen Telekommunikationsdienst. Die Erhebung, Verarbeitung und Speicherung von personenbezogenen Daten und anfallenden Verkehrsdaten regelt das Telekommunikationsgesetz (TKG).

Ein gesonderter Auftragsdatenverarbeitungsvertrag ist bei solchen Telekommunikationsdiensten vom Gesetzgeber nicht vorgesehen.

In English:

GMX TopMail is a telecommunication service. Retrieval, processing, and storing of personal data and any mail detail records are regulated by the telecommunication law (TKG).

The legislator does not assume any separate contract for processing on behalf for such telecommunication services.

It should be noted that this statement refers explicitly to the paid variant of their e-mail service, and that I understand the statement to say "separate contract" (separate from, or in addition to what?).

Answer 1

This is Article 2(4) GDPR:

4. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.

Article 12 of Directive 2000/31/EC:

Article 12

"Mere conduit"

1. Where an information society service is provided that consists of the transmission in a communication network of information provided by a recipient of the service, or the provision of access to a communication network, Member States shall ensure that the service provider is not liable for the information transmitted, on condition that the provider:

   (a) does not initiate the transmission;

   (b) does not select the receiver of the transmission; and

   (c) does not select or modify the information contained in the transmission.

2. The acts of transmission and of provision of access referred to in paragraph 1 include the automatic, intermediate and transient storage of the information transmitted in so far as this takes place for the sole purpose of carrying out the transmission in the communication network, and provided that the information is not stored for any period longer than is reasonably necessary for the transmission.

3. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement.

Note in Germany, this is implemented in Article 1 §8 Telemediengesetz (TMG).

It looks to me this fits an email provider. So Directive 2000/31/EC specifies that such a provider is not liable. And the GDPR specifies it does not change that. That would mean other articles of the GDPR do not apply. That would also mean that you do not need a contract.

Answer 2

Lets set some boundaries on this subject.

Processing Lawfully or not? By default an email provider is providing an email server where emails will be received and can be sent. These emails more than likely are processed through automatic software for viruses, spam, etc. If the provider is not doing anything other than providing the email service than they are not violating the GDPR as they are only processing data for security and legitimate interests of the end user in reducing spam. (Article 6 Section 1f and Recital 49).

So to conclude in most cases presuming an email provider doing just that, providing an email service, than they and you are not violating the GDPR so far.

Consent: The big deal around GDPR is consent. At the point the person emailed you, they gave consent for you to see the email data. This data is not only the email address, subject line, content of the email. But fundamentally all the headers and servers which the email traveled through. Some of which under GDPR is considered personal data. However as the standards for email delivery haven't changed since Oct 2008 AKA RFC 5321 (excluding RFC 7504, which only updates the 521 and 556 reply codes). There is no new personal data which would be transmitted over an email.

You could however argue ignorance of the Data Subject. It's doubtful the common person knows how emails work (SMTP) and what personal data is transmitted along with the email besides their email address, the subject and the content of the email. In which case you could be on the hook for GDPR Recital 32 which pertains to Article 7 of the GDPR.

GDPR Recital 32:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

Keyword there being "informed". However if we are to assume GDPR Recital 32 comes into play in terms of email. Than the most used communication media simply can't be used with any EU citizen and furthermore we all run the risk of violating the GDPR simply by running an email account.

References:

• rfc 5321
• rfc 7504
• GDPR Recital 32
• GDPR Article 7

Answer 3

I think there should be no doubt about that, the email provider is definitely a processor that deals with personal data on your behalf. Whoever processes personal data on your behalf, for whatever reasons, is a processor. Which means that every IT service you use to deal with your customers/users/visitors' data is a processor. The problem is that by this logic in theory your ISP (internet service provider) should be a processor too, because it is able to see, record, and process all the data that goes in an out of your computer, and that includes your customers/users/visitors' personal data. In practice though, I think that if you only use encrypted connections (like https which is now used by every serious service), then your ISP can't see the personal data your are transmitting and receiving, so in practice in most cases I guess the ISP might not be considered a processor.