8

I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this.

The work email address I was contacted on is not listed in the public domain anywhere that I know of (not on the company site, not on LinkedIn etc).

When I questioned the recruiter about where he found my email, they stated that they had:

"[...] had contact with people at [CompanyX] before and know the email syntax".

I can only assume this means they knew I had started work at the company (this information is available on LinkedIn in the public domain) and knew the email syntax, and so used this knowledge to guess my email address and contact me.

Given new GDPR legislation in the UK and Europe, specifically around the need for a company to gain explicit consent to contact someone before doing so, is this approach for contacting people legal under GDPR?

Improve this question
2
  • I would say that the email address generation sounds more like a question of anti-spam legal protections than GDPR; for GDPR the first point would be where did they obtain your name from in order to generate the email address (how do they know that there is a George Harris working at your company?).
    – SJuan76
    Jun 11, 2018 at 16:52
  • See also Using GDPR against cold-call marketing emails
    – wimh
    Aug 8, 2018 at 21:20

1 Answer 1

Reset to default
7

First take a look at Article 13(1) of Directive 2002/58/EC

Article 13

Unsolicited communications

  1. The use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may only be allowed in respect of subscribers who have given their prior consent.

  2. Notwithstanding paragraph 1, where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case the customer has not initially refused such use.

Note that this is a Directive, so it is not directly binding, but each EU member state has created it's own laws containing this. I also quoted paragraph 2 for completeness, but based on your description, it does not apply.

Article 95 GDPR explicitly specifies it does not change any obligations from Directive 2002/58/EC.

So it looks very clear to me the situation you describe is not legal.

Article 14 GDPR allows you to request all information regarding this, which included information how they have exactly obtained your name and email address.

Improve this answer
4
  • 2
    2002/58/EC in the UK is PECR 2003, which unfortunately introduced the term 'individual subscribers' that I think means a work email address is unlikely to be covered by it, at least by ICO's interpretations: ico.org.uk/for-organisations/guide-to-pecr/…
    – Flexo
    Jun 13, 2018 at 20:39
  • That page makes a distinction between corporate subscribers and individual subscribers, where corporate subscribers seems to mean the corporation itself (eg [email protected]). The direct marketing guide gives personal corporate email addresses the same rights as other individuals. It refers to section 11 of the DPA 1998, which just mentions "individuals". So basically if you know the name of the person of a work email address, it is an individual.
    – wimh
    Jun 13, 2018 at 21:28
  • As far as I can make out ICO have taken the view that when a company has a contract for 500 accounts from an email provider for their employees none of those accounts are considered individual subscribers. With regards to their published guide, as I read it the reference to section 11 of DPA is saying "even though the rules of PECR don't apply DPA still does".
    – Flexo
    Jun 13, 2018 at 21:53
  • There's more on this here: 'If you collect personal data from sources other than the individual (eg public sources or from third parties), you must provide privacy information within a reasonable period of obtaining the data and no later than one month from the date of collection.' - ico.org.uk/for-organisations/… I can't tell if 'working out' someone's email address has additional restrictions though.
    – Minkus
    Nov 10 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .