6

I understand that emailing a person without consent is illegal under GDPR.

But is it okay to email someone if the person has made the mail address public? For example if a university professor posted his/her email on the university website (which is publicly open without any login requirement). Is it okay to send them an email?

Improve this question
2
  • Sending one relevant email to a person who has not given explicit consent is fine. But your comment below suggests you want to send a request for review to "10 to 20" people. That is not ok. The advice for one does not scale.
    – bishop
    Nov 23, 2022 at 3:37
  • 13
    Which provision of the GDPR, according to your understanding, prohibits sending e-mail to a person without the person's consent? Where did you get this understanding?
    – phoog
    Nov 23, 2022 at 7:45

2 Answers 2

Reset to default
16

The GDPR doesn't generally distinguish public from non-public personal data.

If you have a good reason to contact the professor, do send them an email. GDPR does not prevent this. If you're sending this email for “purely personal or household purposes”, then GDPR doesn't apply anyway.

There are rules in the ePrivacy Directive against unsolicited emails, but these specifically relate to emails for direct marketing purposes. A company is not allowed to send out spam marketing, regardless of whether they obtained the email address from a public data source. Companies can send email marketing to their own existing customers, or to people who have given consent. Consent is defined in a fairly restrictive way (as a specific, informed, freely given, and unambiguous indication of the data subject's wishes), so that mere publication of an email address cannot be interpreted as consent to receive marketing from a particular company.

Improve this answer
5
  • Thank you very much, it is very helpful !! So I guess it is OK to send 10-20 professors asking them to review a paper? I wont be selling them anything.
    – avila
    Nov 22, 2022 at 19:29
  • 6
    @avila It is legal, but not OK.
    – Azor Ahai -him-
    Nov 22, 2022 at 19:44
  • 19
    @avila You may be able to get additional information about how "welcome" or "reasonable" your plan is on Academia.SE. You also might be able to get a more specific answer to the legality of your situation on this StackExchange with a separate question that has more details. My intuition says your situation would not count as "personal or household purposes" but I am not significantly familiar with relevant EU laws.
    – Kamil Drakari
    Nov 22, 2022 at 19:56
  • @avila *may be legal. Don't know anything about how GDPR applies here.
    – Azor Ahai -him-
    Nov 22, 2022 at 22:24
  • 1
    When GDPR does distinguish public from non-public data, IIRC it's in regard to sensitive personal data. So for example it may be unlawful to keep a list of who supports what political party, but be lawful to keep a list of who has publicly stated (themselves, not public third-party claims) that they support a particular political party. Other conditions still apply: just because that makes a difference in some circumstances doesn't mean your circumstances are the ones to which it makes a difference :-)
    – Steve Jessop
    Nov 23, 2022 at 15:08
0

Emailing a person without consent absolutely isn't illegal under GDPR.

GDPR applies to companies, not generally to individuals.

Furthermore, GDPR wouldn't prevent a commercial entity from emailing someone without consent if there was a legitimate, non-marketing reason for it. To take your example, if I were designing a new widget that used plasma recombobulators for ACME INC I'd be perfectly allowed to email Proffessor Smith (an expert in that field) to ask if he had any useful advice on how to keep the flux capacitor cooled.

What you can't do is spam people with marketing without consent.

Improve this answer
6
  • 3
    -1 "GDPR applies to companies, not generally to individuals." This is by no means correct, although enforcement is mostly aimed at businesses and other large entities.
    – David Siegel
    Nov 23, 2022 at 14:43
  • @DavidSiegel, the legislation specifically excludes "purely personal or household purposes", I'm fairly confident in saying that that translates to not generally applying to individuals. If it's neither personal, nor household, then you're likely communicating as a commercial entity, even if that entity is a sole trader
    – ScottishTapWater
    Nov 23, 2022 at 17:29
  • 1
    and I am fairly confident that you are mistaken. Indeed I believe that there have been courtr cases applying the GDPR to individuals, tho I don't have a cite at hand. Many, perhaps most people's online activities don't fall under the GDPR, true. But whan an individual (as many do) operates a site comperble to what a smal buisness or small non-profit org or local chapter might, the GDPR will apply. It will not apply to emailing an individual academic, no. But arraing peer reviews on a regular basis might well go beyond "purely personal".
    – David Siegel
    Nov 23, 2022 at 18:20
  • 2
    There are pre-GDPR cases that explain that this exception must be interpreted narrowly (C-101/01 Lindqvist, C‑212/13 Rynes). The GDPR does explain though that personal social media use does not fall under the GPDR (see GDPR Recital 18). If I send an email to my aunt, I'm not subject to GDPR. But if I send emails for professional purposes, that might no longer be “purely personal”.
    – amon
    Nov 23, 2022 at 19:38
  • 1
    @amon ... and I won't be surprised if the OP's intention to ask multiple people for review might already count as beyond personal
    – Hagen von Eitzen
    Nov 23, 2022 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.