GDPR Disclaimer On Cold Call Emails

Question

I live in the United States. I am helping someone who just started an online store selling tee shirts. In my research to come up with a plan regarding cold call email marketing, I came across GDPR. Her target market is the US, but she is not opposed to selling to anyone in the EU either. She wants to send advertisements via email to potential customers to introduce her store. In reading about GDPR, I understand the fines can be astronomical for contacting someone who is a citizen of a country governed by GDPR. That is the scenario, here are my questions:

If her intent is to market to US based customers only and has a disclaimer on the ad, will that protect her from violating GDPR? Her disclaimer would look something like this:

"GDPR Disclaimer - This advertisement is intended to introduce potential US based customers to XYZ company...yada yada yada. If you have received this email and if you reside in a country controlled by the GDPR law, this email was not intended for you and was sent to you in error. There is nothing you have to do, you are not subscribed on any list and you will not receive any further contact".

She has obtained a list of hundreds email addresses from the internet. She has no idea who owns a given email address nor what country they reside in. Cold calling (not spamming) is allowed here in the United States. The fact that GDPR strongly discourages it (or outlaws it...not really sure which one when it comes to GDPR) should not preclude her from trying to reach potential customers in her own country. There are some domain extensions she would avoid entirely (such as "de" for Germany) as she would have the assumption any email in that domain would be for Germany and thus controlled by GDPR. Other domains are not that clear cut. The "com" domain is mainly US commercial, but "gmail.com" is a email provider which is global. How can I know if a given email address (for instance "[email protected]" is for a person in the United States, Europe, Australia, Japan or wherever? "jsmith" doesn't even really have to belong to someone with a first initial of "j" and a last name of "smith". It could be an alias for someone else. My point and my question is this. My friend doesn't want to violate GDPR, but at the same time she doesn't want to be precluded from marketing to potential customers in the US. How does she know if an email address is controlled by GDPR. It seems to me that there would have to be a way to know this or it cannot be enforced up to the point when it is discovered. Does this make sense? Is there any repository (online database) that would tell me is a given email address is owned by person who is in a country that is controlled by GDPR? It seems to me that there should be. She should be able to comply with the law by submitting her (say 500) list of email addresses in a query to a GDPR database and it kicking back the 20 or 30 addresses that are protected. In that way, she knows who she can market to and who she can't. As I understand it, there is no such repository so she has to guess which email addresses she can use and which she cannot. That is really unfair and it would essentially block her from reaching out to her intended audience out of fear she should send to someone in a GDPR protected country without intending to or knowing it.

Answer 1

That GDPR Disclaimer is no protection in some jurisdictions: the applicable laws to that situation in germany for example don't care about the GDPR:

Cold calling, mailing, or e-mailing private people to advertise services all is handled by the same law: Without the consent it is expressly illegal under §7 of the law against unfair competition (Gesetz gegen unlauteren Wettbewerb UWG) and such cases are rather Slam-Dunk if the origin can be made out. The punishment can be a 300.000 € fine.

The fact that to email someone you need their e-mail address and that e-mail addresses and private addresses are by default considered personally identifiable information is making it worse for the advertizer: Without either an exception (there is none available to cold-emailing) or special allowance of the person the data belongs to, you violate §4 of the federal data protection law (Bundesdatenschutzgesetzes BDSG) just by handling their e-mail address. That's a separate crime from the UWG one, adding up to another 300.000 € fine under §43 BDSG - or even up to 2 years in prison under §44 BDSG!

Oh, and if the email does not contain a proper sender's address, that's another chance for a huge fine under the UWG...

So, GDPR is your least trouble, if you violate the marketing laws of a country, or their own data privacy laws. A disclaimer means nothing as the act of sending the mail, even to an unintended addressee, is what is illegal and the law as written does not give a damn about 'I didn't want to advertise to that person' when in fact you sent them unwanted advertisements.

Oh, and the very repository you suggest? It would violate the very same §4 BDSG and be illegal for processing private data if it was not actively asked to do that by the end user. As a result, that database is useless: It does kick back all people not in its database. Its database is incomplete because only few people give their address to that database as people not aware of the database never add their data on their own. So it regularly violates §4 BDSG with every German citizen's e-mail address it gets and kicks back, and claiming those addresses would be OK, it throws the company trying to check the database under the bus because they rely on data that is impossible to be reliable.

tl;dr

Don't do cold-(e)-mail marketing. You throw yourself into boiling oil with a lit torch in hand.

further reading

Other laws banning such behavior I had listed here, and I quote myself:

The US has the CAN-SPAM-Act, which illegalizes sending unsocialised advertisements. You may NOT send a mail if any of the following is true:

• it has no opt-out
• the email was gained by 'harvesting'
• contains a header not matching the text
• contains less than one sentence
• the adressee does not have any relation to you

In fact, you are liable for a 5-digit fine per infringing e-mail in the US. The FTC itself suggests to never buy e-mail lists - as E-mail harvesting or generating any possible e-mail adress itself is illegal.

Answer 2

Trish's answer is by and large correct for the German law for the German market. But it does not address the real question: In which cases is German competition law and the GDPR applicable?

§ 7 II Nr. 3 UWG

In the German legal system the prohibitions of the competition law (UWG, Gesetz gegen den unlauteren Wettbewerb) is a type of tort/non-contractual obligation belonging to private law (and not criminal law). The application of the UWG depends on the rules about conflicts of laws. For non-contractual obligation this is the Rome II-Regulation, art. 6 I says:

The law applicable to a non-contractual obligation arising out of an act of unfair competition shall be the law of the country where competitive relations or the collective interests of consumers are, or are likely to be, affected.

It is impossible to affect the competitive relations or the collective interests of consumers in Germany by advertising a product not sold in Germany. An advertising practice only affects the market in the country the advertisement is aimed at. So the affected market is the one of the United States and the US competition law applies.

So: § 7 II Nr. 3 UWG prohibits cold call emails for advertisement but is not applicable to a case of advertisement aiming at the US.

GDPR

The GDPR prohibits cold call email advertising - this is clear (data procession without consent or another legal ground). But is the GDPR applicable?

Art. 3 GDPR regulates the territorial scope of the regulation. Primarily it applies to data controllers established in the EU, but also art. 3 II a):

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union;

The mentioned shop is not established in the EU and does not offer goods to subjects in the Union either. So the GDPR does not apply to it. A disclaimer like the proposed may make this clear; the shop has to refuse any orders in the EU anyway received.

Result

The prohibition on cold call emailing by the German UWG and the GDPR do not apply on the mentioned case, a disclaimer like the proposed seems fine. I don't know of the competition law of other EU member states, but suspect they work similar to the UWG and are esp. subject to art. 6 I Rome II (this regulation applies to all the EU without Denmark).

Trish mentions in their other answer an US-law on this subject, so look at this too. Personally I think it is right to prohibit cold call emailing, but each country has to decide this for its own market.

---

This is a complicated question that might be worthy to ask a real expert.

Answer 3

Is there any repository (online database) that would tell me is a given email address is owned by person who is in a country that is controlled by GDPR? It seems to me that there should be.

I don't think there is one either and I suspect such a repository could, in itself, be somewhat questionable under the GDPR. The safest way not to violate the GDPR is to apply the same standard and, among other things, collecting as little personal data as possible, keeping it only as long as strictly necessary, using it only for the purpose it was intended, and securing proper consent as needed. The law is clearly not structured to give you easy ways out like filtering out EU subjects (as you hope to do) or including overly broad consent or waiver clauses in general terms and conditions.

Realistically, geofencing your site and not selling anything in the EU/delivering to EU addresses should also shield a small business from practical consequences but if you do want to trade in Europe, then the regulation has real teeth and it will be difficult to discriminate and keep doing questionable things elsewhere.

In that way, she knows who she can market to and who she can't. As I understand it, there is no such repository so she has to guess which email addresses she can use and which she cannot. That is really unfair and it would essentially block her from reaching out to her intended audience out of fear she should send to someone in a GDPR protected country without intending to or knowing it.

I don't know how much of this really result from a deliberate plan and how much is overreach and unintended consequences but I have heard at least once that the extraterritorial impact was very much desired. That it could make some business models illegal, impose onerous requirements on foreign businesses, or establish a new worldwide standard would therefore be a feature, not a bug.

Many people have the same reaction when they realise this but ignoring the EU market entirely can cost a lot. The idea is therefore to leverage the EU's size and economic power to ensure that it is not only at the receiving end of US regulations like the Foreign Corrupt Practices Act (FCPA) or the Foreign Account Tax Compliance Act (FATCA) but pushes back with regulation of its own. I can tell you that many executives in the EU do feel the FCPA is very unfair (or cynically meant to interfere with their business).