I think it would be difficult to run such a phone number blocking service legally in Europe.
In this answer, I will assume that the phone blocking service acts in a B2C manner:
consumers/end users can share telephone numbers and notes about these numbers with the service.
In turn, the service will use these submissions as input for an automated decision as to whether to block the number when the number contacts other people.
Furthermore, notes about a number are shared with other users.
Who is the data controller?
Assuming that the end users use this service for purely personal or household purposes, the end users are not data controllers.
Thus, they have no GDPR compliance obligations and are probably able to share other people's personal data with the blocking service.
However, that blocking service is definitely a data controller.
The service determines the purposes and means how the submitted numbers and notes are processed. In a B2C context, the blocking service cannot be a “data processor” as that is a special role when the data is processed solely on behalf of another controller (compare Art 28 GDPR).
Are the submitted phone numbers and notes personal data?
Personal data is any information that relates to an identifiable natural person.
To the degree that these phone numbers relate to natural persons rather than to entities/corporations, the numbers and associated notes are clearly personal data.
What legal basis might the blocking service rely on?
None of the Art 6(1) legal bases (a) – (e) seem to apply.
That only leaves Art 6(1)(e) public interest carve-outs for such services in national law,
or an Art 6(1)(f) legitimate interest.
To determine whether a legitimate interest applies, it is necessary to perform a balancing test.
This test must weigh the legitimate interests (such as the user's legitimate interest in not receiving annoying calls) against the rights and freedoms of the affected persons.
Recital 47 provides some factors that should be taken into account for a legitimate interest assessment:
- reasonable expectations of the data subjects based on their relationship with the controller
- for example, if the data subject is a client or in the service of the controller
- whether the data subject can reasonably expect the further processing at the time and in the context of the collection of the personal data
- whether the processing is strictly necessary for preventing fraud
I think these criteria weigh against a legitimate interest in this scenario.
First, the data subjects have no relationship with the data controller,
and are not aware that their data is being collected.
Thus, they cannot reasonably expect their personal data to be shared via such a service.
Second, the service is not strictly necessary for preventing fraud.
Even if one of the features of this service is to reduce fraudulent calls, there might be less invasive means.
Assuming that a legitimate interest does exist, it is worth noting that Art 21 gives right to object to processing unless these is an overriding legitimate interest.
This is a higher bar to clear than a normal legitimate interest balancing test.
But otherwise, the affected persons could just opt out of the data collection, likely rendering the blocking service useless.
When processing the personal data of data subjects without obtaining the personal data directly from these data subjects,
the GDPR expects certain information to be provided to the data subjects per Art 14.
So in essence, the service would be required to send a privacy notice to all numbers that were sent to the service.
There is an exception to this obligation where providing this information would require disproportionate effort or if it would seriously impair the objectives of processing.
But this requires taking appropriate measures to protect the affected persons' rights and interests, and requires making the relevant information publicly available.
Here, the exception might actually apply since blocking a number might be less effective if the number's owner is notified of the block.
But the second part might be more difficult achieve, i.e. taking suitable measures to protect the affected persons' rights.
Per Art 22, data subjects have the right to not be subject to purely automated decision-making.
Thus, if the service uses automated mechanisms to decide whether a number should be blocked, there would have to be an avenue for appeal that involves human review of the automated decision.
(Note: as of 2021, the UK has signaled that it wants to remove this right to human review in the future).
On the other hand, this right only applies when the decision “produces legal effects … or similarly significantly affects [them]”.
It is possible to argue that using automated means to block them from calling a person who uses the blocking service for purely personal or household purposes means it is not a significant effect in this sense, but I wouldn't want to make this argument.
High risks to the rights and freedoms of the affected data subjects.
Since this service relies on processing personal data in a manner that likely cannot fully respect the affected persons' right to object or to be informed about the processing, there is likely to be a high risk to their rights.
Therefore, an Art 35 Data Protection Impact Assessment (DPIA) is likely to be mandatory,
and possibly also a prior consultation of the service's data protection authority per Art 36.
Parallels to the EUR 250M fine against WhatsApp.
Earlier in 2021, the Irish Data Protection Commission fined WhatsApp for their privacy practices.
A large part of this – accounting for EUR 75M of the fine – related to their handling of phone numbers of non-users.
WhatsApp offers to its users to upload their phone's contact books in order to find other users who also use the service.
WhatsApp used a lossy hashing technique on these non-user phone numbers, and therefore claimed that these didn't constitute personal data.
The decision against WhatsApp notes that these hashed phone numbers still constitute personal data, and that WhatsApp failed to fulfill its Art 14 transparency obligations.
Note: this fine is currently (2021) being appealed on procedural grounds, so it might change. However, the rationale for the fine represents the result of a consensus mechanism between multiple European data protection authorities, and therefore provides valuable insight into authorities' understanding of Art 14.
Possible alternatives that could be more GDPR-compliant.
The above scenario was defined in a manner that makes it fairly straightforward to say that this kind of service will run into GDPR compliance issues. However, slightly different services could have a decent shot at achieving compliance. For example:
The service requires account registration.
Users can only block other users of the service, but not unrelated third parties.
This would weigh in favour of a legitimate interest, since there would be an existing relationship between the data subjects and the service.
Though in practice, I would expect Art 6(1)(b) necessity for performance of a contract to be a better legal basis in that scenario.
The service does not allow users to submit free-form information about numbers, and only allows them to submit pre-defined feedback categories.
The transmission of the feedback uses differential privacy techniques so that each individual record does not allow any inferences to be made about a number.
Thus, the feedback about a number would not be personal data.
Only across multiple reports can the service make probabilistic inferences about the feedback to a phone number.
If the service has collected significant negative feedback about a number that warrants wider blocking,
this would be personal data.
But since this only happens with numbers against which substantial negative feedback has been submitted,
there would be a stronger legitimate interest argument for processing this information.
The service makes it possible to manage blocklists, but without sharing feedback about numbers with other users.
This more limited use of user data would strengthen a legitimate interest argument.
In this context, the blocked numbers would likely relate only to the blocking user, not to the blocked persons.