2

I recently received a "cold-call" email from a salesman to my professional email address, which is in the form firstname.lastname@company.com. The firstname is a very formal version unlikely to be known by non-natives. We are both based in the UK.

  • The address is assigned to me by my company
  • It's not uploaded to my personal Linkedin profile (see edit below)

The message seems personalized and doesn't have an Unsubscribe option.

The salesman claims to have found me through Linkedin. Normally this kind of thing earns a one-way express ticket to the Spam folder, but I'm wondering, can I use GDPR to request either

  • how he found my address, or
  • that I be removed from his list?

edit The message was sent to an alias of the form easy-name.lastlane.company, as opposed to firstname.lastname@company as I had originally thought. Outlook's interface didn't make it obvious that the alias was used. That one can indeed be easily guessed from my Linkedin profile, but is still not public.

  • Is your address firstname.lastname@company.com? – Greendrake Aug 8 '18 at 9:12
  • @Greendrake Yes, but my firstname is a very formal version unlikely to be known by non-natives. The question focuses not on how to prevent my email being discoverable, but on the applicability of GDPR for this purpose (cold-calling) – rath Aug 8 '18 at 9:41
  • 1
    See also Deducing and using an email address under GDPR – wimh Aug 8 '18 at 21:20
  • With the personalization, are you saying the content made this email look like more than a random scrub of [firstname].[lastname]@[companywithLinkedInprofile's domain] ? – jeffronicus Aug 8 '18 at 21:32
  • 1
    @jeffronicus My mistake, upon further inspection the message was indeed sent to easy-name.lastname@example.com, which is an alias to my actual, formal version address, which wasn't obvious from outlook's interface. – rath Aug 8 '18 at 21:47
1

Article 13(1) of Directive 2002/58/EC (in the UK implemented in PECR 2003) is about direct marketing. Article 95 GDPR explains the relation between that directive and the GDPR. The GDPR only applies if personal data is processed.

In a comment you confirm that the email address is like firstname.lastname@company.com. The European Data Protection Board has written a letter to the ICANN (regarding WHOIS) where it clarifies if such an email address is personal data:

The GDPR does not apply to the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. While the contact details of a legal person are outside the scope of the GDPR, the contact details concerning natural persons are within the scope of the GDPR, as well as any other information relating to an identified or indentifiable natural person.

The mere fact that a registrant is a legal person does not necessarily justify unlimited publication of personal data relating to natural persons who work for or represent that organisation, such as natural persons who manage administrative or technical issues on behalf of the registrant.

For example, the publication of the personal email address of a technical contact person consisting of firstname.lastname@company.com can reveal information regarding their current employer as well as their role within the organisation. Together with the address of the registrant, it may also reveal information about his or her place of work.

In light of these considerations, the EDPB considers that personal data identifying individual employees (or third parties) acting on behalf of the registrant should not be made publically available by default in the context of WHOIS. If the registrant provides (or the registrar ensures) generic contact email information (e.g. admin@domain.com), the EDPB does not consider that the publication of such data in the context of WHOIS would be unlawful as such.

So at least because an email address like firstname.lastname@company.com is used, it gets inside the scope of the GDPR. But as Article 95 GDPR explains, only for matters which have no obligations in Directive 2002/58/EC.

Can I use GDPR to request how he found my address

As that is outside the scope of 2002/58/EC, you can use the GDPR to request this. See Article 14(2)(f):

Information to be provided where personal data have not been obtained from the data subject

  1. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:

    (f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

Regarding your second question;

Can I use GDPR to request that I be removed from his list?

The email you describe is clearly unlawful in respect to Directive 2002/58/EC, but also the GDPR would provide you with the right to erasure. So either way you can request to be removed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.