Say I email a colleague, in a professional capacity:

I have been thinking about offering John Smith, who currently works at Big Corp, a job

John Smith has had no involvement with my organisation. As far as I know, he has no idea I even exist.

Is this data now subject to the GDPR? Specifically, does John Smith now have a right of access to this information? Or even, did I need his consent to send this email?

  • How do you know that John Smith exists? The source of the data is relevant.
    – SJuan76
    Commented Jan 13, 2020 at 18:43
  • 1
    @SJuan76 Say, a colleague told me about him Commented Jan 13, 2020 at 20:26
  • In the most insane interpretation, you now have one month to inform the data subject that you're processing their data (per Art 14). I don't think that interpretation is reasonable for unstructured data such as emails. Some guidance I've read says that emails are covered when they relate to the data subject, but that mere mentions aren't sufficient. Under no circumstances would you need their consent to send the email since you have a legitimate interest to conduct business.
    – amon
    Commented Jan 13, 2020 at 20:52
  • @amon Ah... would the situation be different if, say, I structured it in a spreadsheet saved on my computer, perhaps with other names? Commented Jan 13, 2020 at 21:03
  • @amon that sounds like an answer, not a comment.
    – phoog
    Commented Jan 14, 2020 at 0:43

1 Answer 1



That said, though there are plenty of separate compliance issues raised by the question, most are easily soluble. But everything is contextual. To illustrate analytical technique used, let us reuse the example given in another answer[EDIT: apologies, on reflection I meant the clarifying comment I think was placed by the OP], the email about head-hunting John Smith without Mr Smith's prior knowledge.

The legal-analytical starting point for all GDPR compliance is Article 30 [Disclaimer: the writer constructively is a part-owner of gdpr360. For explanation of link choice please see profile], as structurally expanded as necessary to satisfy data subject rights exercise, etc [given that such a metadata artifact is mandatory, from a commercial perspective it makes sense to formalize and reuse it to support all GDPR compliance]. I would record such activities as bundled in with (or separately as an "internal discussion" subprocess) those parts of the recruitment "super-process" whose legal basis is legitimate interests.

Extending it slightly for general interest, if Mr Smith were to be in the EU and the controller is not, the extra-eu transfer hurdle also must be overcome. In this particular case, absent Binding Corporate Rules [itself logically an expanded variant of the Article 30 artifact, the intuitively simplest approach would be to satisfy all the conditions set out in the "wash-up" final paragraph of Article 49(1). This seems likely, providing the final "safeguard" condition is satisfied - say (in US cases) Privacy Shield registration. (notification is discussed below)

For avoidance of doubt none of the derogations available within the GDPR is a universal palliative, despite all the snake-oil that's been sold over the last couple of years. Everything is context-sensitive. If you have a new scenario that doesn't comfortably fit into the analyses previously embedded into your Article 30 metadata artifact, then by definition you have a new process to analyze and record.

Notification is a separate issue. Mr Smith clearly did not supply his info directly, so it's equally clearly an Article 14 rather than Article 13 scenario. The controller therefore technically would have one month to notify. That said, I note the GDPR, as with EU law generally, is not "tick-box" compliance but focuses on outcomes and proportionality. I therefore would regard any technical breach of Notification requirements, in zero-aggravation contexts such as the example, as extremely low financial risk in terms of either fines or compensation. GDPR is rooted in events of 15-20 years ago impacting international comity, and is drafted very widely in order to avoid emasculation-by-loophole (primarily by Member States, but also by multinational controllers), but the John Smith scenario is not one of the policy targets and so neither Supervisors nor data subjects nor Courts seem likely to be troubled by it, unless aggravated by data breach or whatever else is going on.

Great question!

  • 1
    If you are linking to your own web site, you need to be explicit about it. Please see How not to be a spammer.
    – tripleee
    Commented Jan 16, 2020 at 12:35
  • @tripleee: The links are to a copy of the law hosted on his website, and that page adds some decent navigation functionality. I don't think the fact that there's a crumb to his homepage on the top of that page crosses the lines described in the promotion policy. If you disagree I'd recommend raising this situation on Meta for discussion.
    – feetwet
    Commented Jan 16, 2020 at 13:16
  • @tripleee: thank you for your comment. Some time before I read it, (prompted by assistance a couple of days ago from @feetwet) I updated my profile to explain (in second para) my approach to linking. In that I set out my view that another site is better than mine for general browsing of the GDPR (indeed for years I used that). However I've also set out the primary reason I changed (which also is why I even created my own). I'd be grateful if you could read that second para and revert with any additional comments that occur to you. Of course I'm happy to submit to moderator adjudication.
    – gdpr360
    Commented Jan 17, 2020 at 17:07
  • 2
    A simple disclosure sentence when you link to your own site would seem more than adequate; perhaps something along the lines of "Disclosure: I am the owner of gdpr360; see profile for details." No aggravation here, just hoping to avoid misunderstandings going forward.
    – tripleee
    Commented Jan 17, 2020 at 17:11
  • 1
    @tripleee: Thanks, will try to do that in future.
    – gdpr360
    Commented Jan 18, 2020 at 10:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .