-2

I live in the U.S. and am developing a browser extension that grabs a person's first name, last name, and company name from their LinkedIn profile and then attempts to guess their email address based on popular email syntax.

The extension does not send any emails, but does validate the email addresses it guesses to confirm accuracy.

A couple of questions, based on the above info:

  1. Is my application/extension considered a data processor or data controller based on GDPR?
  2. Since I am only providing the user with an email address for the LinkedIn member, am I legally liable for what the user does with that email address (i.e. sending unsolicited messages)?
  3. What information should I store, or not store, for GDPR compliance and my own legal protection? (i.e. should I retain logs of when a user looked up a particular name, and what email was produced? Or should I immediately purge all info?)
Improve this question
1
  • Hey Trish, thanks for the comment. Scraping publicly accessible data from LinkedIn is legal, as noted in this recent article. My question was primarily regarding my legal liability in providing an email address to a user/client ascertained via programmatic means, and whether doing so is in violation of GDPR.
    – Steve
    Jun 20, 2022 at 16:24

1 Answer 1

Reset to default
3

I decided to rewrite this after the clarification in the comments. You can find the old version in the history.

The question is not, actually, about a browser extension. It is about a web service that can be accessed by the browser extension. The way to access the service should make little difference, it could be clay tablets, homing pigeons, or this browser extension, what matters is the service.

The service has two functions:

  1. Receive PII of the victim, sent by the customer, to calculate the probable email of the victim, and return this PII to the customer.
    The service operator could argue that the customer is really the data controller under GDPR rules, and that the service operator is only the data processor, but that is not a plausible use case. The customer would need to get and document the consent of the victim before the probable mail is calculated, so why would the customer pay the service operator for a service like this? There is already contact with the victim.
  2. Generate a database of specific company email patterns to enable 1.
    This would also use PII, from random employees of the company in question, and there is no customer to shield the service provider by pretending that consent was collected.

The way around the first issue might be to sell the database and have all calculations on the customer's system, but that doesn't resolve the second issue, that of creating the database. This involves looking for patterns in PII of individuals, unless the target company is obliging enough to make the pattern public.

Improve this answer
5
  • That is very helpful, thanks. Could you clarify the last portion of your answer? The extension currently connects to a cloud server, where a script does the actual "guessing" (dissecting the first name and last name text, creating probable syntax combinations, and checking to see if it's valid in combination with an @companyname.com suffix). It then sends a message back to the extension, where the user see's the resulting valid email (if any). Are you saying this is or is not a best practice with respect to processing PII?
    – Steve
    Jun 20, 2022 at 18:40
  • @Taco, that cloud server is your problem because it means that the PII goes onto your machine. (The cloud server is '"yours" in this regard.) You might try to create a contract with your customers that makes you the processor and them the controllers, but you definitely need a lawyer in your company (or several) to handle that.
    – o.m.
    Jun 20, 2022 at 18:48
  • thanks for the additional info. Does length of PII retention play a factor at all? For example, the cloud server currently ingests the info, guesses the email, and sends it back to the extension in about 10 seconds. If the cloud server doesn't permanently store or document any PII, would there still be a problem? I agree with you regarding a contract that explicitly defines the role of our application as the processor. Just want to make sure I am understanding the different variables at play.
    – Steve
    Jun 20, 2022 at 18:58
  • @Taco, it does matter, but any time is long enough to get you into trouble. Frankly, this sounds as if you shouldn't even try unless you already have a company with a good legal staff to advise you.
    – o.m.
    Jun 20, 2022 at 19:05
  • I agree, and thanks again. I'll seek out some legal counsel before pursuing further!
    – Steve
    Jun 20, 2022 at 19:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .