Published on · RedData Legal
A named corporate email address is personal data
An address such as firstname.lastname@company.com identifies a natural person and is therefore personal data under article 4(1) of Regulation (EU) 2016/679 (GDPR). The fact that the person acts in a professional capacity does not change that. Generic addresses (info@, sales@) do not identify a person and fall outside the GDPR, but remain protected by article 21 of the Spanish LSSI-CE.
Every use needs a lawful basis
Article 6(1) of the GDPR requires any processing of personal data to rest on a lawful basis. For commercial email, the two usually invoked are consent (6(1)(a)) and legitimate interest (6(1)(f)). However, for email the LSSI-CE acts as the specific rule and requires, save for a prior contractual relationship, the recipient's prior consent. In practice, legitimate interest does not cover a first commercial contact by email with someone who has not given consent.
What valid consent is
Article 4(11) of the GDPR defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they accept the processing through a statement or a clear affirmative action. Article 7 adds that the controller must be able to demonstrate it and that the request must be presented in an intelligible form, separate from other matters. The following are not valid consent:
- Pre-ticked boxes or silence.
- Having found the address on a website, on LinkedIn or in a directory.
- Having bought or rented a database without specific consent for that sender.
- A generic consent to "receive communications from third parties".
The right to object
Article 21(2) of the GDPR recognises the right to object at any time to processing for direct-marketing purposes, in which case the data must no longer be processed for that purpose. Articles 13 and 22 of the LSSI-CE also require a simple, free unsubscribe option in every communication.
Information to the data subject
Where the data is not obtained from the data subject, article 14 of the GDPR requires them to be informed, among other things, of the source of the data, the purpose and the lawful basis. A commercial email sent without this information adds a second infringement to the lack of consent.
Consequences
Processing without a lawful basis is an infringement under article 83(5) of the GDPR, punishable by the AEPD with fines of up to €20 million or 4% of annual turnover, as applicable. Article 82 gives the affected person the right to compensation for the damage suffered. And, as with any unsolicited commercial email, the LSSI-CE penalty regime applies in parallel.