I was recently contacted on a work email address by a recruiter, working from a private recruitment agency. I have had no prior contact with this recruiter or agency before this.
The work email address I was contacted on is not listed in the public domain anywhere that I know of (not on the company site, not on LinkedIn etc).
When I questioned the recruiter about where he found my email, they stated that they had:
"[...] had contact with people at [CompanyX] before and know the email syntax".
I can only assume this means they knew I had started work at the company (this information is available on LinkedIn in the public domain) and knew the email syntax, and so used this knowledge to guess my email address and contact me.
Given new GDPR legislation in the UK and Europe, specifically around the need for a company to gain explicit consent to contact someone before doing so, is this approach for contacting people legal under GDPR?