Using GDPR against cold-call marketing emails

Question

I recently received a "cold-call" email from a salesman to my professional email address, which is in the form [email protected]. The firstname is a very formal version unlikely to be known by non-natives. We are both based in the UK.

• The address is assigned to me by my company
• It's not uploaded to my personal Linkedin profile (see edit below)

The message seems personalized and doesn't have an Unsubscribe option.

The salesman claims to have found me through Linkedin. Normally this kind of thing earns a one-way express ticket to the Spam folder, but I'm wondering, can I use GDPR to request either

• how he found my address, or
• that I be removed from his list?

---

edit The message was sent to an alias of the form easy-name.lastlane.company, as opposed to firstname.lastname@company as I had originally thought. Outlook's interface didn't make it obvious that the alias was used. That one can indeed be easily guessed from my Linkedin profile, but is still not public.

Answer 1

Article 13(1) of Directive 2002/58/EC (in the UK implemented in PECR 2003) is about direct marketing. Article 95 GDPR explains the relation between that directive and the GDPR. The GDPR only applies if personal data is processed.

In a comment you confirm that the email address is like [email protected]. The European Data Protection Board has written a letter to the ICANN (regarding WHOIS) where it clarifies if such an email address is personal data:

The GDPR does not apply to the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. While the contact details of a legal person are outside the scope of the GDPR, the contact details concerning natural persons are within the scope of the GDPR, as well as any other information relating to an identified or indentifiable natural person.

The mere fact that a registrant is a legal person does not necessarily justify unlimited publication of personal data relating to natural persons who work for or represent that organisation, such as natural persons who manage administrative or technical issues on behalf of the registrant.

For example, the publication of the personal email address of a technical contact person consisting of [email protected] can reveal information regarding their current employer as well as their role within the organisation. Together with the address of the registrant, it may also reveal information about his or her place of work.

In light of these considerations, the EDPB considers that personal data identifying individual employees (or third parties) acting on behalf of the registrant should not be made publically available by default in the context of WHOIS. If the registrant provides (or the registrar ensures) generic contact email information (e.g. [email protected]), the EDPB does not consider that the publication of such data in the context of WHOIS would be unlawful as such.

So at least because an email address like [email protected] is used, it gets inside the scope of the GDPR. But as Article 95 GDPR explains, only for matters which have no obligations in Directive 2002/58/EC.

Can I use GDPR to request how he found my address

As that is outside the scope of 2002/58/EC, you can use the GDPR to request this. See Article 14(2)(f):

Information to be provided where personal data have not been obtained from the data subject

2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:

   (f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

Regarding your second question;

Can I use GDPR to request that I be removed from his list?

The email you describe is clearly unlawful in respect to Directive 2002/58/EC, but also the GDPR would provide you with the right to erasure. So either way you can request to be removed.