10

The GDPR defines personal data as:

Personal data is information that relates to an identified or identifiable individual.

My understanding is that this means that [email protected] is personal data, but [email protected] is not. Looking at the list of Data Protection Officers at the ICO site there are all sorts of emails, some obviously personal and many that appear generic. I could write an algorithm to try and determine if any email is in one class or another, but it could go wrong (perhaps Sally Ales is truncated to sales@ or David Peter Oliver to dpo@).

If I wanted to process this list (excluding personal information so as to be sure of compliance with the GDPR), is there an approved, recommended or even just suggested method of programmatically determining if an email address is personal information or not? It is worth noting that there are over 1 million rows in the data protection public register above, so a programmatic solution is required.

Improve this question
3
  • 1
    Is this not a question about the nature of email, and programming? Rather than a question about the law? You seem to be very clear about what the law is in this area.
    – user46677
    Commented Sep 6, 2022 at 10:40
  • There's only convention to give you reason that [email protected] is actually owned and operated by a person with that actual name. That sounds like circumstance to me. If you also have firstname and lastname fields in your data, making a "contains" comparison seems trivial.
    – user608
    Commented Sep 8, 2022 at 13:16
  • Forget truncating, the problem is way worse: "sales" is a common surname! Other things like "legal", "bank', "market" can also be found on surnames, too.
    – T. Sar
    Commented Sep 8, 2022 at 18:56

4 Answers 4

Reset to default
30

Treat all email addresses as if they are personal data.

All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address.

If your list contains the email addresses of data protection officers then all of them are personal data.

The only exception I could see would be email addresses that clearly belong to a corporation that is they are addresses of a legal person which is not a natural person.

Improve this answer
5
  • 6
    You say, "The only exception I could see would be email addresses that clearly belong to a corporation that is they are addresses of a legal person which is not a natural person." It it possible to detect this programmatically? I think this is what the question is asking.
    – user46677
    Commented Sep 6, 2022 at 21:39
  • 10
    @user133469: With my programmer hat on, I honestly would be pretty shocked if there was a way to do that. Email is an old protocol - it doesn't have any built-in concept of "this mailbox belongs to a person, that mailbox belongs to a corporation," so you're pretty much stuck with looking at the address and guessing. For that matter, the relevant RFCs explicitly discourage the sender from parsing or trying to interpret the "local part" (the part before the @) of an address, and are extremely lax in what they allow in that portion of the address.
    – Kevin
    Commented Sep 6, 2022 at 23:20
  • @Kevin we can use knowledge bases to determine. (e.g., checking with list of known corporation addresses, doing a search for a named corporation with the same name as the domain part of the e-mail address, etc.) But agree that no method will have 100% certainty, as we can only know for sure that an e-mail address belong to a corporation if said corporation has already confirmed publicly that they own that e-mail address (such as by putting it on their website).
    – justhalf
    Commented Sep 7, 2022 at 6:02
  • 2
    In short, @Kevin is saying that you cannot accurately programmatically determine an e-mail fits the legal definition of personal information, so assume they are all personal. Then you don't have to worry about this.
    – Greg Burghardt
    Commented Sep 7, 2022 at 20:10
  • @user46677 why would you ever practivally need this to? Even if you manage to discern these "non GDPR protected" adresses, if they leak you can likely still be sued by the companies. Just not under GDPR but that's not gonna help much.
    – Hobbamok
    Commented Oct 24, 2022 at 9:06
15

As quarague correctly points out, you cannot reliably determine whether an email address is personal data. But since nearly all email addresses are personal data, you should treat all addresses in your database as personal data by default to be safe.

Just because something is personal data doesn't mean that you would be forbidden from using this information. Instead, think about the purpose of your processing activity, and then consider whether this activity is covered by one of the Art 6(1) GDPR legal bases.

In your specific scenario, you are scraping a list of data protection officers. Since this list will contain some personal data, already the act of scraping involves processing of personal data and would need a legal basis, regardless of what you later do with the email addresses. Regardless of privacy issues this also raises questions regarding copyright, but I'll ignore those here.

A potential strategy for extracting those DPO email addresses that are not personal data could be as follows. In practice, all DPOs are identifiable. But in some cases, their address might relate more to the company than to the particular officer. Therefore, you would want to filter out any records that might relate to an individual.

  • Keep only records where the company name indicates that it is a corporation. You may have to cross-reference this with information from Companies House.
  • Discard records that named a DPO, as opposed to just giving contact details.
  • Keep only records where the email address is a well-known role account name for DPOs, e.g. dpo@, privacy@, legal@, and so on.
    • Manual review of discarded addresses might show other addresses that clearly are role accounts.
Improve this answer
1
  • 1
    You have to be careful with that third bullet. I know companies where email addresses are derived from (for example) the first few letters of your first name and the first few letters of your last name. [email protected] might refer to the legal department, or might refer to Leonard Galloway.
    – bta
    Commented Sep 8, 2022 at 20:03
7

Email should be treated as personal data. There is no long or complicated answer here. Even if it has no names or anything, they can sometimes be traced back to a real person so they are personal data. For example, if there is an email on your db saying hdksjdhsjdhsjdhsjerieri@somedomain... etc that belongs to a joe bloggs and it were leaked from your server. Then somebody found out from another site that joe bloggs email is this, they then know joe bloggs is a member of your site as well.

Improve this answer
5

All email addresses are personal data

This is because they can be combined with other information to identify a natural person.

For your example of [email protected], for a sufficiently small organisation, that email might be accessible by an individual or a sufficiently small number of individuals that a trivial piece of additional data could identify the individual. Even in a larger organisation, the internal routing algorithm will ensure that any given email is brought to the attention of an individual - the address combined by the algorithm identifies that individual.

The DPO example is even worse- each organisation only has one DPO and their name must be published.

Improve this answer
10
  • 5
    While the DPO will always be identifiable, it does not follow that any email address will also relate to that officer. The GDPR's definition of personal data only covers information that relates to an identifiable person, not any information that can be connected to an identifiable person. See also the ICO guidance on the relates-to criterion ico.org.uk/for-organisations/guide-to-data-protection/…
    – amon
    Commented Sep 6, 2022 at 21:11
  • @amon it depends if that information can be used to identify a person. ICO state "or has an impact on them (see the chapters on the meaning of ‘relates to’ and indirectly identifying individuals, below)." Lookup online identifiers, which is on another page. ico.org.uk/for-organisations/guide-to-data-protection/…
    – moo
    Commented Sep 7, 2022 at 17:02
  • 2
    In the general case, email addresses cannot be combined with other information to identify a natural person. For example, emails sent to the "support@" address for the company I work for will end up in three different mailboxes, and it's anybody's guess as to who will get to it first. "fax@" is even less identifiable: it used to be the address of the fax machine; these days, it's the address of the fax inbox.
    – Mark
    Commented Sep 8, 2022 at 1:51
  • 1
    @Mark Not at all. Your company email will have logs of who accessed a given email first, last and in the middle. Combine that with the address and you have an identifiable person. It doesn't matter if it's hard to do, it matters if it's possible.
    – Dale M ♦
    Commented Sep 8, 2022 at 2:07
  • 1
    @Mark but it can - my MFP has the capacity to lock documents with PIN codes - personally identifiable information.
    – Dale M ♦
    Commented Sep 8, 2022 at 2:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .