8

I originally asked this question on Information Security and it was suggested it was a better fit over here.

I'm a member of the management committee of an allotment society in the UK. The committee maintains a list of society members' email addresses to keep in contact with them. Before GDPR started on the 25th of May this year an email was sent to all members on this list asking them to opt in to future communications. Most members replied positively.

At a meeting last night, the Secretary of the committee said that she had received emails from members who had not opted in advising of health and safety issues on the site. She said the National Allotment Society's policy was that these emails could not even be read because of GDPR. She added that an email was then sent to the original sender advising of this.

I have looked what GDPR says about emails and it seems to concentrate on not sending unsolicited emails and making sure that an organisation has explicit consent to store data. From what I understand we have a lawful reason to process this email but we do not have explicit consent for anything.

My question is this: does GDPR prohibit reading unsolicited emails from people who have not explicitly opted in to a mailing list?

  • Explicit consent to store data should be somewhat orthogonal to reading it. If you can even debate whether to read an email or not, you have already stored it. – pipe Sep 6 '18 at 8:46
  • 3
    Nonsense. If someone drops in your letterbox an "unsolicited" letter addressed in your name, do you think you will not be allowed to read it? – Greendrake Sep 6 '18 at 9:07
  • 1
    @Greendrake, nonsense is a polite way of saying what I did at the meeting. The policy is apparently that though, however impractical and unworkable it may be. I think somebody has taken the interpretation of explicit consent to be on a mailing list way too far. However, I'm not an expert on GDPR hence why I'm here seeking clarification. – BWFC Sep 6 '18 at 9:17
  • 3
    On the subject of clarification, I'm going to ask the Secretary for a copy of the policy. That of course assumes that the policy allows her to forward it to me! – BWFC Sep 6 '18 at 9:19
4

Does GDPR prohibit reading unsolicited emails from people who have not explicitly opted in to a mailing list?

tl;dr:

No. I have never heard of this, and I don't see how this could follow from the GDPR. You should follow up with the Secretary to find out how she came to her conclusion.


Detailed reasoning:

The GDPR restricts the processing of personal data, so it does in principle cover reading email, since reading counts as "processing", and an email may contain personal data. However, Article 2 (emphasis mine) says that:

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.

I would read this to mean that a human reading emails is only covered by GDPR if the emails are part of a "filing system" or intended to be. So reading the emails is ok, it's only problematic if you intend to systematically store them.

Even filing them, while covered by GDPR, would presumably be allowed, because to actually act on the email, you would have to keep it, and Article 6 allows processing of personal data to "take steps at the request of the data subject prior to entering into a contract" and when "processing is necessary for the purposes of the legitimate interests pursued by the controller".

One caveat: If the email contains data that falls under special categories of personal data (Article 9) you may need explicit consent for storage. That covers things like racial or ethnic origin, political opinions, religious beliefs and health information. So if someone discloses a health problem or their religious belief in their mail, you may need to ask them for permission to keep it.

In summary: At most, GDPR would require you to promptly delete the email once you no longer need it (which could be immediately if the email is irrelevant to you). If the email contains data you legitimately need (e.g. a complaint you need to follow up on), you are allowed to keep it as required (based on Article 6 (f)). Note that in both cases no explicit consent is required from the email sender, unless the email contains particularly sensitive data, such as political/religious beliefs or health data.

  • 2
    That is essentially the conclusion I'd come to while reading around the subject this morning. We have legitimate reasons to read the email and if necessary to keep it. The fact that the email was sent implies permission to read it. That is where I think the issue arose. The sender has not given explicit consent to be contacted and the National Allotment Society went for better safe than sorry. I've asked the Secretary for a copy of the policy and I'll come back when I've had a look at it myself. It's not impossible there's been a misinterpretation of a misinterpretation. – BWFC Sep 6 '18 at 10:22
  • Yes, exactly. As to "explicit consent", note that GDPR only requires "explicit consent" for "special categories of personal data". For other data, it only requires "consent", which is defined to be "by a statement or by a clear affirmative action". So implicit consent is ok. – sleske Sep 6 '18 at 10:28
2

TL;DR: Reading an email "with your eyes" is not the problem, since reading is not even a form of data processing. It's all the rest that might become a problem: what you do after reading it, what your systems (or third-party systems) do automatically with your emails, etc.


It all depends on what you are going to do with those emails, or even what you are doing without even realizing it (like automatic backups, scanning, processing, archiving, etc). You don't always need explicit consent to deal with personal data. For example you could process personal data on the basis of "legitimate interests", without any consent.

Let's suppose you only use the personal data in your emails to answer them and maybe do the job or task the sender requests. For example, somebody might send you an email saying they are interested in something you do, and asking you to call them back at a phone number. What are you going to do? Of course you can use that personal data to answer the email and make a phone call, and you can keep a backup of that data for some time (but not forever). All this is legitimate processing of personal data, it is expected and understood by the users, and doesn't need any consent.

Now let's suppose you use the personal data in your emails build a list of interests of the users, and send that list to someone else that will use it for commercial purposes. This would not be legitimate without an explicit consent. This means that you could not do this automatically for every email you receive, it would be illegal. You would have to check if the sender had already given you explicit consent for this kind of processing. It is ok to send them an email to ask for their consent. What you cannot do is to start processing their personal data for the above-mentioned commercial purposes without their explicit consent.

So "reading" an email is not a problem at all. The problem is what you are actually doing with the personal data after you read the email, or what you (or someone else, for example Google in Gmail?) might already be doing automatically even before you read it.

For more detailed information on this I think you need to look for "lawful basis for processing" or something like that in the GDPR law (Article 6). Also look for definitions and notes on "legitimate interests". An interesting quote on this, from the GDPR law (emphasis added by me):

The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.