european-union gdpr
Does GDPR Prohibit Reading Unsolicited Emails?
<p>I originally asked this question on Information Security and it was suggested it was a better fit over here.</p>

<p>I'm a member of the management committee of an allotment society in the UK. The committee maintains a list of society members' email addresses to keep in contact with them. Before GDPR started on the 25th of May this year an email was sent to all members on this list asking them to opt in to future communications. Most members replied positively.</p>

<p>At a meeting last night, the Secretary of the committee said that she had received emails from members who had not opted in advising of health and safety issues on the site. She said the National Allotment Society's policy was that these emails <em>could not even be read</em> because of GDPR. She added that an email was then sent to the original sender advising of this.</p>

<p>I have looked what GDPR says about emails and it seems to concentrate on not sending unsolicited emails and making sure that an organisation has explicit consent to store data.  From what I understand we have a lawful reason to process this email but we do not have <em>explicit</em> consent for anything.</p>

<p>My question is this: <strong>does GDPR prohibit reading unsolicited emails from people who have not explicitly opted in to a mailing list?</strong></p>

<blockquote>
  <p>Does GDPR prohibit reading unsolicited emails from people who have not
  explicitly opted in to a mailing list?</p>
</blockquote>

<p><strong>tl;dr:</strong></p>

<p>No. I have never heard of this, and I don't see how this could follow from the GDPR. You should follow up with the Secretary to find out how she came to her conclusion.</p>

<hr>

<p><strong>Detailed reasoning:</strong></p>

<p>The GDPR restricts the <em>processing</em> of <em>personal data</em>, so it does in principle cover reading email, since reading counts as "processing", and an email may contain personal data. However, Article 
2 (emphasis mine) says that:</p>

<blockquote>
  <p>This  Regulation applies to  the  processing of  personal data  wholly
  or  partly  by  automated  means and  to  the processing other than by
  automated means of personal data which <strong>form part of a filing system</strong> or
  are <strong>intended to form part of a filing system</strong>.</p>
</blockquote>

<p>I would read this to mean that a human reading emails is only covered by GDPR if the emails are part of a "filing system" or intended to be. So reading the emails is ok, it's only problematic if you intend to systematically store them.</p>

<p>Even filing them, while covered by GDPR, would presumably be allowed, because to actually act on the email, you would have to keep it, and Article 6 allows processing of personal data to "take steps at the request of the data subject 
prior to entering into a contract" and when "processing 
is  necessary  for  the  purposes  of  the  legitimate interests  pursued 
by  the  controller".</p>

<p>One caveat: If the email contains data that falls under <strong>special 
categories of personal data</strong> (Article 9) you may need explicit consent for storage. That covers things like racial or ethnic origin, political 
opinions, religious beliefs and health information. So if someone discloses a health problem or their religious belief in their mail, you may need to ask them for permission to keep it.</p>

<p><strong>In summary:</strong> At most, GDPR would require you to promptly delete the email once you no longer need it (which could be immediately if the email is irrelevant to you). If the email contains data you legitimately need (e.g. a complaint you need to follow up on), you are allowed to keep it as required (based on Article 6 (f)). Note that in both cases no explicit consent is required from the email sender, unless the email contains particularly sensitive data, such as political/religious beliefs or health data.</p>

<p><strong>TL;DR:</strong> Reading an email "with your eyes" is not the problem, since reading is not even a form of data processing. It's all the rest that might become a problem: what you do after reading it, what your systems (or third-party systems) do automatically with your emails, etc.</p>

<hr>

<p>It all depends on what you are going to do with those emails, or even what you are doing without even realizing it (like automatic backups, scanning, processing, archiving, etc). You don't always need explicit consent to deal with personal data. For example you could process personal data on the basis of "legitimate interests", without any consent.</p>

<p>Let's suppose you only use the personal data in your emails to answer them and maybe do the job or task the sender requests. For example, somebody might send you an email saying they are interested in something you do, and asking you to call them back at a phone number. What are you going to do? Of course you can use that personal data to answer the email and make a phone call, and you can keep a backup of that data for some time (but not forever). All this is legitimate processing of personal data, it is expected and understood by the users, and doesn't need any consent.</p>

<p>Now let's suppose you use the personal data in your emails build a list of interests of the users, and send that list to someone else that will use it for commercial purposes. This would <strong>not</strong> be legitimate without an explicit consent. This means that you could not do this automatically for every email you receive, it would be illegal. You would have to check if the sender had already given you explicit consent for this kind of processing. It is ok to send them an email to ask for their consent. What you cannot do is to start processing their personal data for the above-mentioned commercial purposes without their explicit consent.</p>

<p>So "reading" an email is not a problem at all. The problem is what you are actually doing with the personal data after you read the email, or what you (or someone else, for example Google in Gmail?) might already be doing automatically even before you read it.</p>

<p>For more detailed information on this I think you need to look for "lawful basis for processing" or something like that in the GDPR law (Article 6). Also look for definitions and notes on "legitimate interests". An interesting quote on this, from the GDPR law (emphasis added by me):</p>

<blockquote>
  <p>The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, <strong>taking into consideration the reasonable expectations of data subjects based on their relationship with the controller.</strong> Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. At any rate the existence of a legitimate interest would need careful assessment including whether a <strong>data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.</strong> The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing.</p>
</blockquote>
