2

Suppose, a scientist is planning to publish a paper, and his email address will be printed on it. I'm wondering, if the European General Data Protection Regulation would be relevant in that case.

According to Article 13, one has to inform anyone whose personal data is collected:

  1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (...)

Article 4 explains, what "personal data" means:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (...)

(Source: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679)

Mail addresses are probably personal data, and if someone writes an email to the contact address that's on the paper, his address (as well as the mail itself) will be stored in the email-account of the scientist. Therefore, personal data would be processed. Does the scientist have to inform about that (according to Article 13)? And how should he do that?

Improve this question

2 Answers 2

Reset to default
1

Point 4 of the same article 13 states:

Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information

It is up to a judge to decide, but I would expect any of them to conclude that any e-mail user already knows that the value he configures in his e-mail as sender address will appear to the recipient of whatever e-mail he sends.

Improve this answer
1
  • But he doesn't know for how long it will be stored. Article 13 also states, that one has to inform about "(...) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;"
    – Me223
    Aug 31, 2018 at 21:34
0

There is no need to inform in this case. The email address and other personal data is covered by legitimate interest exceptions, as it is necessary to conduct the business of publishing a scientific paper.

Since they are sending an email to you, they know how to contact you for any GDPR related queries, so there is no need to supply a separate data handling address.

You may be required to respond to Data Subject Access Requests. You can simply search your inbox for identifiers (email address, name) to handle that.

Improve this answer
2
  • While there might be a legitimate interest for processing such as storage, I can't find any exception to the Art 13 or Art 14 information obligations. An insane/strict reading of the GDPR would indeed suggest that any data controller would have to auto-respond to all incoming emails with a complete privacy notice.
    – amon
    Aug 7, 2022 at 20:55
  • @amon It's generally enough to link to the privacy notice in your signature, if you have one. Not everyone is required to have one.
    – user
    Aug 8, 2022 at 15:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .