1

Company Contacts page

From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B. For instance my private email is regulated by GDPR, but my work email is not. When my company has a contacts web-page what can actually be included without my consent?

  1. Name - yes
  2. Picture - yes
  3. Work email - yes
  4. Phone ???

Company paid cell phone

If I had a separate SIM card for my company paid cell phone, then I would agree it could be posted on the contacts page. Now it happens to be one of the fringe benefits of the company that they pay your cell-phone upto a certain amount. Does this give them the right to publish my number on their web-site without my consent?

7
  • Where are you? Do you pay for incoming calls? Jun 15, 2018 at 12:05
  • 8
    Why would your work e-mail not be regulated by GDPR? Which part of the regulation exempts a work e-mail address from consideration as "information relating to an identified or identifiable natural person"? Also, I am not aware that GDPR regulates the publication of data. I would expect that it continues to be governed by existing privacy protections.
    – phoog
    Jun 15, 2018 at 15:40
  • 1
    @phoog I agree that a personal corporate email address is regulated by the GDPR. (And for the same reason a company paid phone number would also identify a natural person). But I also think that publishing data is regulated by the GDPR. It fits Art. 4(2) GDPR, the European Commission even includes the example posting/putting a photo of a person on a website.
    – wimh
    Jun 15, 2018 at 21:02
  • 1
    @Per Digre In both cases consent is needed. And at least in Germany you are not allowed to be fired or any other disadvantages if you do not give consent. Oct 15, 2018 at 4:38
  • 2
    @FabianBarney consent is not always needed for lawful processing of data that falls under the GDPR. Consent is only one of six bases for lawful processing. The last of these is "legitimate interests of the data controller," which probably includes publishing telephone numbers that the company maintains in order for its employees to be reached by outside parties.
    – phoog
    Jul 26, 2022 at 11:15

2 Answers 2

1

From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B

Thia is not at all correct. There is nothing in the GDPR that exempts a data controller from its provisions because the data is "B2B". It is true that the GDPR does not protect data that identifies businesses and other entities that are not natural persons. But a natural person is still a natural person when s/he is an employee. Data that identifies or is associated with an employee is still personal data.

The question also seems to assumes that publication of any data associated with a person requires that person's consent under the GDPR. That is also incorrect. The GDPR requires a lawful basis for any processing. Storage is processing. So is posting to a web site, whether internal to a business or on the open internet. All such processing requires a lawful basis. Consent is only one of the six possible lawful bases available under the GDPR.

A company that wants to post an employee directory, or the contact info of selected employees so that a customer can send communications to them, may obtain the consent of those employees, which may be the simplest basis to establish. Or it might also use legitimate interest. It certainly seems to me that a business has a legitimate interest in letting its customers know how to reach the proper employee to deal with the customer's needs.

It does not matter who pays for a telephone, a telephone number that is associated with a specific natural person is still personal data (PD). A business still needs a lawful basis to process such a number, but any of the six bases will do, it does not have to be consent. This is true for PD in general.

-1

When my company has a contacts web-page what can actually be included without my consent?

If it would be on a intranet (ie. only visible inside your company), your name, picture, work email and work phone number can be put on that page. This is because it would be important that coworkers know each other and can contact each other.

On a public website (visible to anybody), the situation would be different. Basically I think nothing can be put on the web page without your consent. Everything is personal data, and there is no real reason to put it on the website. In some countries it is not possible to ask consent from employees, because it would never be freely given. In that case such a contact page is not possible at all.

However if you are part of the management team or sales team, there might be good reasons to put contact data on a public website. Those will be people which represent the company. So it might be important that (potential) customers see this information. However I can also imagine it would be sufficient to add all contact data (including a picture) just to email messages.

Now it happens to be one of the fringe benefits of the company that they pay your cell-phone upto a certain amount. Does this give them the right to publish my number on their web-site without my consent?

No, I don't see why that would change anything. If it is your private phone number, it would not even be ok for coworkers to get that phone number. Only the management might have reasons to contact you in your private time.

3
  • 1
    "it would not even be ok for coworkers to get that phone number". In other words our internal contacts directory is illegal ??
    – Per Digre
    Nov 22, 2018 at 8:16
  • It depends. If you agreed that the company pays partially or completely for your private phone, and you agreed to have the phone number in their contacts directory, it would be legal. If you ask them to remove your phone number and they say "we will, but we will stop paying for your phone", that would probably also be legal. The right thing would be: Only make private phone numbers public if the company decided that it is important (not automatically), and only if they talked to the employee first, and the employee agreed.
    – gnasher729
    Jul 26, 2022 at 10:25
  • -1 This answer badly misstates what the GDPR does and does not require Jul 26, 2022 at 13:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .