3

It seems already sufficiently established that a contract for processing on behalf according to GDPR Art. 28 is necessary with one's web hoster.

Now, I am wondering whether the same is true for the e-mail provider that provides the e-mail address that serves as the official contact address for a website. Do I need a contract for processing on behalf with my e-mail provider, if they host the address that might receive inquiries from strangers who have visited my website?

My straightforward guess would be that my e-mail inbox can contain more personal data about people who visited my website by orders of magnitude than a server log that just stores IP addresses ever will.

On the other hand, I notice that at least e-mail providers here in Germany do not seem to offer any templates for such contracts (unlike various local web hosters). Furthermore, the only really explicit statement on the matter that I could find appears to come from one such e-mail provider, GMX, saying:

Bei GMX-TopMail handelt es sich um einen Telekommunikationsdienst. Die Erhebung, Verarbeitung und Speicherung von personenbezogenen Daten und anfallenden Verkehrsdaten regelt das Telekommunikationsgesetz (TKG).

Ein gesonderter Auftragsdatenverarbeitungsvertrag ist bei solchen Telekommunikationsdiensten vom Gesetzgeber nicht vorgesehen.

In English:

GMX TopMail is a telecommunication service. Retrieval, processing, and storing of personal data and any mail detail records are regulated by the telecommunication law (TKG).

The legislator does not assume any separate contract for processing on behalf for such telecommunication services.

It should be noted that this statement refers explicitly to the paid variant of their e-mail service, and that I understand the statement to say "separate contract" (separate from, or in addition to what?).

2

This is Article 2(4) GDPR:

  1. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.

Article 12 of Directive 2000/31/EC:

Article 12

"Mere conduit"

  1. Where an information society service is provided that consists of the transmission in a communication network of information provided by a recipient of the service, or the provision of access to a communication network, Member States shall ensure that the service provider is not liable for the information transmitted, on condition that the provider:

    (a) does not initiate the transmission;

    (b) does not select the receiver of the transmission; and

    (c) does not select or modify the information contained in the transmission.

  2. The acts of transmission and of provision of access referred to in paragraph 1 include the automatic, intermediate and transient storage of the information transmitted in so far as this takes place for the sole purpose of carrying out the transmission in the communication network, and provided that the information is not stored for any period longer than is reasonably necessary for the transmission.

  3. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement.

Note in Germany, this is implemented in Article 1 §8 Telemediengesetz (TMG).

It looks to me this fits an email provider. So Directive 2000/31/EC specifies that such a provider is not liable. And the GDPR specifies it does not change that. That would mean other articles of the GDPR do not apply. That would also mean that you do not need a contract.

  • 2
    An email provider does not just provide a "transmission" service, but also a storage service, at least. The emails will be available for as long as the user wants to, until the user deletes them. So I don't think the article you quoted makes sense in this case. – reed Jun 24 '18 at 20:36
  • 2
    Article 13 of 2000/31/EC covers storing ("Caching"). – wimh Jun 24 '18 at 21:52
1

Lets set some boundaries on this subject.

Processing Lawfully or not? By default an email provider is providing an email server where emails will be received and can be sent. These emails more than likely are processed through automatic software for viruses, spam, etc. If the provider is not doing anything other than providing the email service than they are not violating the GDPR as they are only processing data for security and legitimate interests of the end user in reducing spam. (Article 6 Section 1f and Recital 49).

So to conclude in most cases presuming an email provider doing just that, providing an email service, than they and you are not violating the GDPR so far.

Consent: The big deal around GDPR is consent. At the point the person emailed you, they gave consent for you to see the email data. This data is not only the email address, subject line, content of the email. But fundamentally all the headers and servers which the email traveled through. Some of which under GDPR is considered personal data. However as the standards for email delivery haven't changed since Oct 2008 AKA RFC 5321 (excluding RFC 7504, which only updates the 521 and 556 reply codes). There is no new personal data which would be transmitted over an email.

You could however argue ignorance of the Data Subject. It's doubtful the common person knows how emails work (SMTP) and what personal data is transmitted along with the email besides their email address, the subject and the content of the email. In which case you could be on the hook for GDPR Recital 32 which pertains to Article 7 of the GDPR.

GDPR Recital 32:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

Keyword there being "informed". However if we are to assume GDPR Recital 32 comes into play in terms of email. Than the most used communication media simply can't be used with any EU citizen and furthermore we all run the risk of violating the GDPR simply by running an email account.

References:

  • 1
    Thank you for your answer. You seem to say that if an e-mail provider is "only processing data for security and legitimate interests of the end user in reducing spam", there is no need to set up a contract for processing on behalf with them. I have two doubts about that: First, the situation appears to be the same for webhosters whose servers do nothing else than answer HTTP requests and log IP addresses for security purposes. Yet, the consensus appears to be that website owners need a contract for processing on behalf with these hosters. Second, it is my understanding that one of the ... – O. R. Mapper Jun 17 '18 at 20:45
  • 1
    ... purposes of said contracts is to give the controller a legally binding confirmation that the processor does not do anything beyond "only processing data for security and legitimate interests of the end user in reducing spam". Thus, what the e-mail provider is doing seems to be irrelevant compared to what they could be doing. – O. R. Mapper Jun 17 '18 at 20:48
1

I think there should be no doubt about that, the email provider is definitely a processor that deals with personal data on your behalf. Whoever processes personal data on your behalf, for whatever reasons, is a processor. Which means that every IT service you use to deal with your customers/users/visitors' data is a processor. The problem is that by this logic in theory your ISP (internet service provider) should be a processor too, because it is able to see, record, and process all the data that goes in an out of your computer, and that includes your customers/users/visitors' personal data. In practice though, I think that if you only use encrypted connections (like https which is now used by every serious service), then your ISP can't see the personal data your are transmitting and receiving, so in practice in most cases I guess the ISP might not be considered a processor.

  • 1
    Thank you for your answer. Your initial statements seem to mirror an interpretation that I outlined in my question. However, could you add some additional insight that also takes into account the opposing interpretations I have mentioned in the question? – O. R. Mapper Jun 17 '18 at 20:51
  • 1
    @O.R.Mapper, I don't know if in Germany there's some special law that allows email providers to act that way, which might cause confusion. Also, I don't think even lawyers can be trusted as far as GDPR is involved: the law is too new, deals with technical matters that can be pretty complex, and there have been no significant lawsuits so far. IMO, as I said, email providers are processors if a controller uses them to send and receive personal data. If email providers are not processors, then who is? GDPR would be a joke in that case. – reed Jun 19 '18 at 10:11
  • 1
    "If email providers are not processors, then who is?" - indeed, I see why it sounds questionable to assume e-mail providers might not be processors. On the other hand, the idea that suddenly, the vast majority of active internet users in Germany (or even the entire EU) would be banned from publishing anything online (a blog, art, open source software, ...) unless they switch to a business e-mail account (which appear to be the only ones for which DPAs are offered) seems equally "surreal". – O. R. Mapper Jun 23 '18 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.