gdpr email
How to fulfill the General Data Protection Regulation (GDPR) when receiving emails
<p>Suppose, a scientist is planning to publish a paper, and his email address will be printed on it. I'm wondering, if the European General Data Protection Regulation would be relevant in that case.</p>

<p>According to Article 13, one has to inform anyone whose personal data is collected:</p>

<blockquote>
  <ol>
  <li>Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data
  are obtained, provide the data subject with all of the following
  information: (...)</li>
  </ol>
</blockquote>

<p>Article 4 explains, what "personal data" means:</p>

<blockquote>
  <p>‘personal data’ means any information relating to an identified or
  identifiable natural person (‘data subject’); an identifiable natural
  person is one who can be identified, directly or indirectly, in
  particular by reference to an identifier such as a name, an
  identification number, location data, an online identifier (...)</p>
</blockquote>

<p>(Source: <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679" rel="nofollow noreferrer">http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679</a>)</p>

<p>Mail addresses are probably personal data, and if someone writes an email to the contact address that's on the paper, his address (as well as the mail itself) will be stored in the email-account of the scientist. Therefore, personal data would be processed. Does the scientist have to inform about that (according to Article 13)? And how should he do that?</p>

<p>Point 4 of the same article 13 states:</p>

<blockquote>
  <p>Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information</p>
</blockquote>

<p>It is up to a judge to decide, but I would expect any of them to conclude that any e-mail user already knows that the value he configures in his e-mail as sender address will appear to the recipient of whatever e-mail he sends.</p>

<p>There is no need to inform in this case. The email address and other personal data is covered by legitimate interest exceptions, as it is necessary to conduct the business of publishing a scientific paper.</p>
<p>Since they are sending an email to you, they know how to contact you for any GDPR related queries, so there is no need to supply a separate data handling address.</p>
<p>You may be required to respond to Data Subject Access Requests. You can simply search your inbox for identifiers (email address, name) to handle that.</p>
