An email address is personal data under the GDPR whenever it identifies a living person, directly or indirectly, such as firstname.lastname@company.com. A generic address such as info@company.com usually is not, because it points to an organisation rather than to one individual; so most address books contain personal data, but not every address in them does.
The GDPR (in Dutch: AVG) has applied directly in the Netherlands since 25 May 2018, supplemented by the Dutch GDPR Implementation Act (Uitvoeringswet AVG). Once an email address qualifies as personal data, every use of it needs a legal basis, and marketing emails are also governed by Article 11.7 of the Dutch Telecommunications Act (Telecommunicatiewet).
Ano ang personal na datos sa ilalim ng GDPR?
Personal data (persoonsgegevens) is any information relating to an identified or identifiable natural person. A person is identifiable if he can be identified directly or indirectly, for example through a name, an identification number, location data or an online identifier.
An IP address or a device ID can be an online identifier in the same way as an email address. The definition only covers living individuals: information about a company as such is not personal data, although information about the people working there can be. The GDPR applies to every organisation that processes personal data of people in the EU, wherever it is based.
Kailan itinuturing na personal na datos ang isang email address?
When the address, alone or combined with other information you hold or can reasonably obtain, points to one identifiable person. The GDPR has no separate rule on email addresses; you apply the general identifiability test to each address.
- firstname.lastname@gmail.com shows the user’s name, so the person is identifiable from the address alone: personal data.
- initials.lastname@company.com shows initials, surname and employer, which together usually identify the individual: personal data.
- puppy12@hotmail.com reveals nothing about the user by itself. It becomes personal data once you can link it to a person, for example through your customer file or a support ticket.
- info@company.com or sales@company.com belongs to an organisation or function and is often used by several people: usually not personal data. If only one named person uses it, the analysis can change.
What counts is the possibility of identification, not your intention. An address that can reasonably be used to identify someone is personal data even if you never use it for that purpose. A publicly available address, for example on a company website, does not lose its status as personal data.
Espesyal ba ang datos ng kategorya ng isang email address?
No. Article 9(1) GDPR reserves the special categories for data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and for genetic, biometric and health data and data on sex life or sexual orientation.
An email address reveals none of this by itself, so the stricter rules for special categories do not apply. The content of an email can be a different matter: a message about someone’s illness contains health data. The address itself is ordinary personal data and must be protected as such.
Kailan nalalapat ang GDPR sa iyong paggamit ng mga email address?
As soon as you process them. Processing is defined broadly: collecting, recording, storing, organising, using, disclosing and deleting all count, automated or not.
For each use you need one of the legal bases in the GDPR, such as consent, performance of a contract with the person or your legitimate interest. Consent must be a freely given, specific, informed and unambiguous indication of wishes (Article 4(11) GDPR). Under Article 5 of the Dutch Implementation Act, where you rely on consent from a child under 16, you generally need consent from a parent or guardian instead.
Which rules apply to marketing emails?
Article 11.7 of the Telecommunications Act prohibits unsolicited commercial emails unless the recipient gave prior consent. The rule applies on top of the GDPR and is supervised by the Authority for Consumers and Markets (ACM); the GDPR itself is supervised by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP).
There are two main exceptions. Under Article 11.7(4) you may email your own customers about your own similar products or services, if you offered them a free and easy opt-out when you collected the address and in every message. Under Article 11.7(3) the consent requirement does not apply to businesses using electronic contact details that the recipient has designated and published for receiving such communications, within the purposes linked to those details.
Ano ang dapat mong suriin bilang isang organisasyon?
- Assume that your email lists contain personal data unless you can show otherwise per address.
- Record a legal basis for each use: newsletter, customer service, sales, internal directory.
- Keep proof of consent for marketing emails and an opt-out link in every message.
- Include email lists in your record of processing activities, retention schedule and security measures.
- Mention the processing of email addresses in your privacy statement.
What should you check as the person whose address is used?
- Check whether you gave consent, or are an existing customer, before you receive marketing emails.
- Use the opt-out in the message; it must be free and easy.
- Ask the organisation which data it holds about you and on what legal basis.
- If the organisation does not respond properly, you can file a complaint with the AP, or with the ACM for unsolicited marketing.
What can we do for you with email addresses and the GDPR?
Ang aming Mga abogado sa IT at privacy advise organisations on email data and marketing compliance.
- We assess which of your email lists qualify as personal data.
- We determine the correct legal basis for each use and document it.
- We review your newsletter and marketing flows against Article 11.7 of the Telecommunications Act.
- We draft or update your privacy statement and record of processing activities.
- We respond on your behalf to questions or complaints from the AP or the ACM.
Buod
- An email address is personal data if it identifies a living person, directly or indirectly.
- Name-based addresses usually qualify; generic addresses such as info@ usually do not.
- An email address is not special category data under Article 9(1) GDPR.
- Every use of a personal email address needs a legal basis under the GDPR.
- Marketing emails also require prior consent under Article 11.7 of the Telecommunications Act, with limited exceptions.
Mga madalas itanong
Personal ba ang datos ng isang shared mailbox tulad ng sales@company.com?
Generally not, because it is linked to a function or department rather than to one person. If only one named person uses it, it can become personal data.
Can I use email addresses for marketing?
Only with a legal basis under the GDPR and with prior consent under Article 11.7 of the Telecommunications Act, unless an exception applies, such as emails to your own customers about similar products with an opt-out in every message.
Is a public email address still personal data?
Yes. Publication does not change the status of the data; it can only affect which legal basis fits your use.
