united-kingdom gdpr european-union data-protection personal-information
Is there a way to determine if an email address is personal information?
<p>The <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/what-is-personal-data/" rel="noreferrer">GDPR defines personal data as</a>:</p>
<blockquote>
<p>Personal data is information that relates to an identified or identifiable individual.</p>
</blockquote>
<p>My understanding is that this means that firstname.lastname@example.com is personal data, but sales@example.com is not.  Looking at the <a href="https://ico.org.uk/ESDWebPages/Search" rel="noreferrer">list of Data Protection Officers at the ICO site</a> there are all sorts of emails, some obviously personal and many that appear generic.  I could write an algorithm to try and determine if any email is in one class or another, but it could go wrong (perhaps Sally Ales is truncated to sales@ or David Peter Oliver to dpo@).</p>
<p>If I wanted to process this list (excluding personal information so as to be sure of compliance with the GDPR), is there an approved, recommended or even just suggested method of programmatically determining if an email address is personal information or not?  It is worth noting that there are over 1 million rows in the data protection public register above, so a programmatic solution is required.</p>

<p>Treat all email addresses as if they are personal data.</p>
<p>All email addresses that belong to a specific person are personal data of that person, regardless of the specific form of the address.</p>
<p>If your list contains the email addresses of data protection officers then all of them are personal data.</p>
<p>The only exception I could see would be email addresses that clearly belong to a corporation that is they are addresses of a legal person which is not a natural person.</p>

<p>As <a href="https://law.stackexchange.com/a/84060/20476">quarague correctly points out</a>, you cannot reliably determine whether an email address is personal data. But since nearly all email addresses are personal data, you should treat all addresses in your database as personal data by default to be safe.</p>
<p>Just because something is personal data doesn't mean that you would be forbidden from using this information. Instead, think about the purpose of your processing activity, and then consider whether this activity is covered by one of the Art 6(1) GDPR legal bases.</p>
<p>In your specific scenario, you are scraping a list of data protection officers. Since this list will contain some personal data, already the act of scraping involves processing of personal data and would need a legal basis, regardless of what you later do with the email addresses. Regardless of privacy issues this also raises questions regarding copyright, but I'll ignore those here.</p>
<p>A potential strategy for extracting those DPO email addresses that are not personal data could be as follows. In practice, all DPOs are <em>identifiable</em>. But in some cases, their address might <em>relate</em> more to the company than to the particular officer. Therefore, you would want to filter out any records that <em>might</em> relate to an individual.</p>
<ul>
<li>Keep only records where the company name indicates that it is a corporation. You may have to cross-reference this with information from Companies House.</li>
<li>Discard records that named a DPO, as opposed to just giving contact details.</li>
<li>Keep only records where the email address is a well-known role account name for DPOs, e.g. <code>dpo@</code>, <code>privacy@</code>, <code>legal@</code>, and so on.
<ul>
<li>Manual review of discarded addresses might show other addresses that clearly are role accounts.</li>
</ul>
</li>
</ul>

<p>Email should be treated as personal data. There is no long or complicated answer here. Even if it has no names or anything, they can sometimes be traced back to a real person so they are personal data. For example, if there is an email on your db saying hdksjdhsjdhsjdhsjerieri@somedomain... etc that belongs to a joe bloggs and it were leaked from your server. Then somebody found out from another site that joe bloggs email is this, they then know joe bloggs is a member of your site as well.</p>

<h2>All email addresses are personal data</h2>
<p>This is because they can be combined with other information to identify a natural person.</p>
<p>For your example of sales@example.com, for a sufficiently small organisation, that email might be accessible by an individual or a sufficiently small number of individuals that a trivial piece of additional data could identify the individual. Even in a larger organisation, the internal routing algorithm will ensure that any given email is brought to the attention of an individual - the address combined by the algorithm identifies that individual.</p>
<p>The DPO example is even worse- each organisation only has one DPO and their name <em>must</em> be published.</p>
