gdpr phone
GDPR and a cell phone paid through work?
<h1>Company Contacts page</h1>

<p>From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B. For instance my private email is regulated by GDPR, but my work email is not.
When my company has a contacts web-page what can actually be included without my consent?</p>

<ol>
<li>Name  - yes</li>
<li>Picture  - yes</li>
<li>Work email - yes</li>
<li>Phone   ???</li>
</ol>

<h1>Company paid cell phone</h1>

<p>If I had a separate SIM card for my company paid cell phone, then I would agree it could be posted on the contacts page. Now it happens to be one of the fringe benefits of the company that they pay your cell-phone upto a certain amount. Does this give them the right to publish my number on their web-site without my consent?</p>

<blockquote>
<p>From what I understand, the contact information at work is not regulated by GDPR since it is considered B2B</p>
</blockquote>
<p>Thia is not at all correct. There is nothing in the GDPR that exempts a data controller from its provisions because the data is &quot;B2B&quot;. It is true that the GDPR does not protect data that identifies businesses and other entities that are not natural persons.  But a natural person is still a natural person when s/he is an employee. Data that identifies or is associated with an employee is still personal data.</p>
<p>The question also seems to assumes that publication of any data associated with a person requires that person's consent under the GDPR.  That is also incorrect. The GDPR requires a <em><strong>lawful basis</strong></em> for any processing. Storage is processing. So is posting to a web site, whether internal to a business or on the open internet. All such processing requires a lawful basis.  Consent is only one of the six possible lawful bases available under the GDPR.</p>
<p>A company that wants to post an employee directory, or the contact info of selected employees so that a customer can send communications to them, may obtain the consent of those employees, which may be the simplest basis to establish.  Or it might also use legitimate interest. It certainly seems to me that a business has a legitimate interest in letting its customers know how to reach the proper employee to deal with the customer's needs.</p>
<p>It does not matter who pays for a telephone, a telephone number that is associated with a specific natural person is still  personal data (PD). A business still needs a  lawful basis to process such a number, but any of the six bases will do, it does not have to be consent. This is true for PD in general.</p>
