1

I live in Ireland and I've been doing business with an Irish company. That company has using a third party for its main IT system and this system has been sending me e-mails.

Just recently I've had a problem with the original company who are claiming to have sent me details on some work that I don't remember receiving. Their response was to tell me the exact time and date (to the nearest second) when I opened the e-mail!

After doing a bit of analytics on other mails they sent me, I discovered the following:

<img src="http://third-party.company.com/wf/open?upn=unique-300-character-identifier" alt="" width="1" height="1" border="0">

For non-tech people: what has happened here is that a unique image that is too small to be seen has been embedded in the mail message. When the e-mail is opened that image is downloaded from a remote server, which would have record the time and date the mail was opened.

I am really unhappy about being tracked.

From a legal POV:

  1. I've not consented to this
  2. Can the third-party, which is based in the UK, collect this data
  3. Can the third-party share it with a company in EU country
  4. I can't see any legitimate business requirement that either company could have for tracking me.

Legally, where do I stand.

2
  • Are you doing business with this company as an individual/customer/client or on behalf of a company? (from your question it would seem you are working as some sort of contractor)
    – AsheraH
    Jan 9 at 8:34
  • @AsheraH, I have to be a bit careful here; I don't want to identify any of the companies/individuals on a public forum. I'm actually a tech guy trying to help somebody else who is worried. My way in was the concern that "How can they track me, when I didn't download any attachments". Neither of us are contractors and neither of us have access to a company legal department (hence the question)
    – Stormcloud
    Jan 10 at 10:11

1 Answer 1

2

It would seem to me that a company with which you are doing business has a legitimate reason to confirm that you did or did not receive their messages, just as they would be entitled to send you postal mail with a return receipt if they choose to. They already know the contents of the email, because they are either the sender or the receiver, so the only additional information the tracking pixel gives them is the timestamp of your access to the email.

You could perhaps stop this by instructing your browser or other email program not to download images, or to prompt you for permission on each image.

Since the Irish company you are doing business with is in the EU (and you are also), the GDPR should apply. Thus they ought to have a lawful basis to process any personal data (PD) relating to you under GDPR Article 6. Under [Article 13], when a Data Controller (DC) obtains Personal Data (PD) from the data subject, it is supposed to notify the subject that it has done so, and provide certain information to the subject. Article 13 paragraph 1 states:

Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

  • (a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;
  • (b) the contact details of the data protection officer, where applicable;
  • (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
  • (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
  • (e) the recipients or categories of recipients of the personal data, if any;
  • (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

Article 13 paragraph 2 states:

In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:

  • (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
  • (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
  • (c) where the processing is based on point (a) of Article 9(2) [consent], the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
  • (d) the right to lodge a complaint with a supervisory authority;
  • (e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;
  • (f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Note that the DC need not provide this information if the DS already has it. It might be buried in a long ToS document or privacy policy.

There is a somewhat similar set of information, albeit different in detail, to be provided under Article 14 when the DC obtains PD from a third party. The obligation under article 14 does not apply when the DS already has the information, when it is impossible or unreasonably hard to comply, or in any of several other conditions.

You could request of the Irish DC that they supply you with the information required under article 13 or 14. You could make the same request of the "third party company" but they are probably acting as a Data Processor (DP) in which case the obligation is on the DC.

You could also make a data access request under Article 15 winch states:

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

This is followed by a list of the details to be provided by the DC.

  1. Can the third-party, which is based in the UK, collect this data

If the third-party is acting as a Data Processor, in accordance with a contract with the DC, they have to same right to collect the information as the DC would have if the DC did this directly, and must abide by the same restrictions, They may share this data with the DC, and with others only at the DC's direction, for which direction the DC is responsible.

Under article 27 a Processor not established in the EU must appoint a representative within the EU to with requests and complaints may be addressed. If the data begin processed does not include "special" data (mostly Personally Identifiable Information) " and is unlikely to result in a risk to the rights and freedoms of natural persons" no representative is required. You are entitled to request the contact info of the representative. (A DC not in the EU must also have a representative.)

  1. Can the third-party share it with a company in EU country

Under [Article 44] transfers to counties outside the EU are restricted:

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. 2All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

Articles 45 thru 50 specify the specific situations under whch such transfers are lawful. Under article 13(1) (f) the DS should be informed of any intention to make such a transfer when the data is collected.

I [can't] see any legitimate business requirement that either company could have for tracking me.

As I mentioned above, knowing whether and when you read a communication is probably legitimate. Additional tracking might not be. I can find no law or regulation prohibiting such tracking,. but the results are surely PD subject to the GDPR and all its applicable provisions.

Legally, where do I stand?

It seems that the Irish Company may have violated the GDPR (arts 13 or 14) by not informing you of the information collected. You could request that info, and also access to all PD they have about you under art 15 (linked above). The relevant supervisory authority in Ireland is the Data Protection Commission. Further relevant information is available on the DPC site, and that is where a complaint could be made.

The GDPR does not, in most cases, give a DS a personal right to sue a DC. on the page "Raising a concern with the commission"_ the DPC writes:

In today’s business world most organisations take data protection very seriously, and the majority of issues are resolved without ever needing to raise a conern [sic] with the DPC. However, if you have contacted an organisation about a personal data concern, in keeping with the guidance provided in our ‘Know Your Rights’ section and you are unhappy with the outcome, you can raise the matter with the Data Protection Commission through our online form.

3
  • @DavidSiegal, Thanks so much for the info - it's so comprehensive. Just as an aside, WRT the 'missing' e-mail that triggered all of this. From my POV knowing when the mail was opened isn't particularly useful; it's not like any mail applications or portals let you search on this. Eventually I did find the mail he was talking about, and yes I did open it. Unfortunately it didn't have the information I expected, which is why I assumed that the real mail had not been sent.
    – Stormcloud
    Jan 9 at 16:44
  • 1
    @Stormcloud If a matter comes to a court case, proof that an email had been opened before some other action was taken or message sent might be useful to the sender. Jan 9 at 16:57
  • @DavidSiegal good point. It does mean that when the Irish company said they knew when the e-mail had been opened they they were not trying to be helpful. One more thing occurred to me. The purpose of that unique 300 character string was to identify the mail and through that the recipient. Does that make the string "Personally Identifiable Information?", after all, that it's is only purpose.
    – Stormcloud
    Jan 10 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.