There are similar answers to queries around this but I just wanted to introduce this scenario to get some advice.

Company A provides pharmaceutical products to Company B Company B is a pharmacy

Company A has created a learning platform which Company B will use to track training modules.

There is invitation functionality on the site where a supervisor of company B can invite their employees to sign up the learning platform.

So the supervisor is entering their employee's name and email (could be company email or personal) but this is all personal data.

So based on previous answers to similar questions. Am I right in saying that this is not compliant because the employee has not given their consent to be sent this invitation email (even though the employee works for the company B)

1 Answer 1


Giving consent is not the only legal basis for processing of personal data. Article 6(1) GDPR lists all situations where processing of personal data is allowed.

If I understand your question correctly, Company A has a learning platform to teach about the products it sells. Company B buys products from Company A. Company B wants its employees to know how to use those products.

In that case Company B has a legitimate interest to add its employees to the learning platform. This is condition (f) of Article 6:

  1. Processing shall be lawful only if and to the extent that at least one of the following applies:

    (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Because you say it are pharmaceutical products, there might also be a legal obligation because prescribing a wrong product is dangerous. But I don't know if that is the case.

Also note that in many EU countries, consent would not even be possible because there is a imbalanced relationship between an employer and an employee, see for example the ICO website or this page from the European Commission:

The employer-employee situation is generally considered as an imbalanced relationship in which the employer wields more power than the employee. Since consent has to be freely given, and in light of the imbalanced relationship, your employer in most cases can’t rely on your consent to use your data.

But besides that, the GDPR also requires data minimisation. See Article 5(1)(c):

  1. Personal data shall be:

    (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

Possibly, instead of the employee's name, a pseudonym could be used to reach the same goal. But there might also be reasons a pseudonym could not be used, for example if at the end of the course a certificate is received which lists the employee's name.

However, it might be unlawful if a personal email address is used instead of a company email address. In particular because that email address was not collected for that purpose.

  • I think that legitimate interests can be used for the platform. But the invitation functionality must require consent from the individual before using the mailing functionality to send the mail. Aug 13, 2018 at 10:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .