Is blocking third-party phone numbers GDPR-compliant?

Question

To be compliant with GDPR you have to process phone numbers as personal data.

Suppose there is a service which users can subscribe to in order to block calls from numbers which the users nominate. The person whose number that is may not even know of the existence of the blocking service.

The blocking service obviously needs to process the blocked phone number in order to provide the service to its users. But the person whose personal data that is has [probably] not given permission for the processing of that personal data.

The service user is the data controller and the service is the processor. Is this GDPR-compliant, say under Article 1(f)? Or another provision? Or is it incompatible with GDPR?

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

   f. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Answer 1

I think it would be difficult to run such a phone number blocking service legally in Europe.

Scenario. In this answer, I will assume that the phone blocking service acts in a B2C manner: consumers/end users can share telephone numbers and notes about these numbers with the service. In turn, the service will use these submissions as input for an automated decision as to whether to block the number when the number contacts other people. Furthermore, notes about a number are shared with other users.

Who is the data controller? Assuming that the end users use this service for purely personal or household purposes, the end users are not data controllers. Thus, they have no GDPR compliance obligations and are probably able to share other people's personal data with the blocking service. However, that blocking service is definitely a data controller. The service determines the purposes and means how the submitted numbers and notes are processed. In a B2C context, the blocking service cannot be a “data processor” as that is a special role when the data is processed solely on behalf of another controller (compare Art 28 GDPR).

Are the submitted phone numbers and notes personal data? Yes. Personal data is any information that relates to an identifiable natural person. To the degree that these phone numbers relate to natural persons rather than to entities/corporations, the numbers and associated notes are clearly personal data.

What legal basis might the blocking service rely on? None of the Art 6(1) legal bases (a) – (e) seem to apply. That only leaves Art 6(1)(e) public interest carve-outs for such services in national law, or an Art 6(1)(f) legitimate interest.

To determine whether a legitimate interest applies, it is necessary to perform a balancing test. This test must weigh the legitimate interests (such as the user's legitimate interest in not receiving annoying calls) against the rights and freedoms of the affected persons. Recital 47 provides some factors that should be taken into account for a legitimate interest assessment:

• reasonable expectations of the data subjects based on their relationship with the controller
  • for example, if the data subject is a client or in the service of the controller
  • whether the data subject can reasonably expect the further processing at the time and in the context of the collection of the personal data
• whether the processing is strictly necessary for preventing fraud

I think these criteria weigh against a legitimate interest in this scenario. First, the data subjects have no relationship with the data controller, and are not aware that their data is being collected. Thus, they cannot reasonably expect their personal data to be shared via such a service. Second, the service is not strictly necessary for preventing fraud. Even if one of the features of this service is to reduce fraudulent calls, there might be less invasive means.

Assuming that a legitimate interest does exist, it is worth noting that Art 21 gives right to object to processing unless these is an overriding legitimate interest. This is a higher bar to clear than a normal legitimate interest balancing test. But otherwise, the affected persons could just opt out of the data collection, likely rendering the blocking service useless.

Transparency obligations. When processing the personal data of data subjects without obtaining the personal data directly from these data subjects, the GDPR expects certain information to be provided to the data subjects per Art 14. So in essence, the service would be required to send a privacy notice to all numbers that were sent to the service.

There is an exception to this obligation where providing this information would require disproportionate effort or if it would seriously impair the objectives of processing. But this requires taking appropriate measures to protect the affected persons' rights and interests, and requires making the relevant information publicly available. Here, the exception might actually apply since blocking a number might be less effective if the number's owner is notified of the block. But the second part might be more difficult achieve, i.e. taking suitable measures to protect the affected persons' rights.

Automated decision-making. Per Art 22, data subjects have the right to not be subject to purely automated decision-making. Thus, if the service uses automated mechanisms to decide whether a number should be blocked, there would have to be an avenue for appeal that involves human review of the automated decision. (Note: as of 2021, the UK has signaled that it wants to remove this right to human review in the future). On the other hand, this right only applies when the decision “produces legal effects … or similarly significantly affects [them]”. It is possible to argue that using automated means to block them from calling a person who uses the blocking service for purely personal or household purposes means it is not a significant effect in this sense, but I wouldn't want to make this argument.

High risks to the rights and freedoms of the affected data subjects. Since this service relies on processing personal data in a manner that likely cannot fully respect the affected persons' right to object or to be informed about the processing, there is likely to be a high risk to their rights. Therefore, an Art 35 Data Protection Impact Assessment (DPIA) is likely to be mandatory, and possibly also a prior consultation of the service's data protection authority per Art 36.

Parallels to the EUR 250M fine against WhatsApp. Earlier in 2021, the Irish Data Protection Commission fined WhatsApp for their privacy practices. A large part of this – accounting for EUR 75M of the fine – related to their handling of phone numbers of non-users. WhatsApp offers to its users to upload their phone's contact books in order to find other users who also use the service. WhatsApp used a lossy hashing technique on these non-user phone numbers, and therefore claimed that these didn't constitute personal data. The decision against WhatsApp notes that these hashed phone numbers still constitute personal data, and that WhatsApp failed to fulfill its Art 14 transparency obligations.

Note: this fine is currently (2021) being appealed on procedural grounds, so it might change. However, the rationale for the fine represents the result of a consensus mechanism between multiple European data protection authorities, and therefore provides valuable insight into authorities' understanding of Art 14.

Possible alternatives that could be more GDPR-compliant. The above scenario was defined in a manner that makes it fairly straightforward to say that this kind of service will run into GDPR compliance issues. However, slightly different services could have a decent shot at achieving compliance. For example:

• The service requires account registration. Users can only block other users of the service, but not unrelated third parties. This would weigh in favour of a legitimate interest, since there would be an existing relationship between the data subjects and the service. Though in practice, I would expect Art 6(1)(b) necessity for performance of a contract to be a better legal basis in that scenario.

• The service does not allow users to submit free-form information about numbers, and only allows them to submit pre-defined feedback categories. The transmission of the feedback uses differential privacy techniques so that each individual record does not allow any inferences to be made about a number. Thus, the feedback about a number would not be personal data. Only across multiple reports can the service make probabilistic inferences about the feedback to a phone number. If the service has collected significant negative feedback about a number that warrants wider blocking, this would be personal data. But since this only happens with numbers against which substantial negative feedback has been submitted, there would be a stronger legitimate interest argument for processing this information.

• The service makes it possible to manage blocklists, but without sharing feedback about numbers with other users. This more limited use of user data would strengthen a legitimate interest argument. In this context, the blocked numbers would likely relate only to the blocking user, not to the blocked persons.

Answer 2

GDPR article 6 paragraph 1(f), quoted in the question, would seem to provide a lawful basis for such processing. Paragraph 1(d):

(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

might also furnish a lawful basis, if blocking unwanted calls is seen as a "vital interest", which it might or might not be.

Update

Recital 46 makes it clear that Article 6 Paragraph 1(d) will not apply in this situation, as sugested in a comment by Amon.

End Update

Under GDPR Article 14 certain information must be provided to a data subject when information about that subject is obtained from a third party. This includes:

1(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;
1(b) the contact details of the data protection officer, where applicable;
1(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
1(d) the categories of personal data concerned;
1(e) the recipients or categories of recipients of the personal data, if any; 1(f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.

In this case parts of paragraph 2 of the article probably also apply, specifically:

2(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
2(b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
2(c)the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;
...
2(e) the right to lodge a complaint with a supervisory authority;
2(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;
2(g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Paragraphs 2(b) and 2(f) of Article 14 might be particularly relevant to a blocking service as described in the question.

Update

I read the question as as saying that a user would provide a number to be blocked to teh service, which would then block calls transmitted via that service to the user, but that this number would not be published or shared with other users. It seems th Amon had read it differently in the answer that Ampon posted

End Update