internet gdpr european-union germany
Is it GDPR-compliant to require *public* publishing of personal info as condition for access to a service?
<p>Background: For roughly 2 decades I've run my own private email infrastructure for myself, open source projects, and a few other individuals over business internet service intended for such usage. I've recently run into a major German ISP blocking my site (this is a new thing; I used to send to their customers with no problem) and interrupting communication with one of their customers I need to correspond with.</p>

<p>After a few weeks of back-and-forth with their email engineering contact giving me moving-goalposts/bait-and-switch about what they want me to do to get unblocked from their system, they are now insisting that I publish legal name and physical street address for the responsible party (that would be me personally) on the web as a condition to access their service.</p>

<p>Is this sort of requirement legal under the GDPR? I could understand (while strongly objecting to, but that's not part of the legal question here) "sorry, we won't open our service to you", but making an offer to provide access but making it conditional on what amounts to doxing oneself seems like it should not be legal. Is this (demanding I publish it publicly rather than give them the same information privately) some loophole for skirting around the GDPR? Is there anything else legally sketchy about the demand?</p>

<p>I am not in Germany; the other party involved is.</p>

<p>More details copied from clarifying comments I posted on an answer (sorry, some of this is technical and may not be useful to non-IT folks):</p>

<blockquote>
  <p>The data was requested after a long series of individual email exchanges with their email engineering department (which has its own separate mail system that's not blocking my site). No emails were flagged as spam and no spam has ever been sent from my site to their mail system. (Fewer than 50 total emails have ever been sent from my site to them.) They seem to have instituted their own in-house policy for IP addresses to accept from based on IP block ownership data (note: not using any of the well-run RBL/DUL type lists) and allow-listing well-known sites.</p>
  
  <p>Rejection takes place before the SMTP session even begins (error message prior to EHLO, giving the address of the email engineering department which I then contacted). Initial request was that I provide "full contact info" on webserver associated with domain the IP address reverses to in order to be unblocked, with no indication of what that would entail. Eventually after being (apparently intentionally) vague for a long time they started insisting that include physical street address. </p>
</blockquote>

<p>Basically, the actionable thing I want to know is whether I have grounds to say something like "The offer to accept mail from my site under the conditions of having published physical contact information constitutes a solicitation for personal data protected by GDPR, and if you are soliciting such personal data, you are required by law to accept it via a secure and private channel."</p>

<p>From a German perspective, it would be absolutely normal and expected that you're providing identity &amp; contact information publicly. Per <a href="https://dejure.org/gesetze/TMG/5.html" rel="nofollow noreferrer">§5 TMG</a> (<em>Impressumspflicht</em>  / <em>Anbieterkennzeichnung</em>) this is required for German tele-media offerings, such as websites or email providers, even if non-commercial. Whereas for you as an upstanding and diligent email provider an <code>abuse@...</code> address should be enough, the German context expects a street address where you could be served with a lawsuit…</p>

<p>There absolutely are privacy and free speech issues with this compelled self-doxxing. But by running an email service, you're not just acting as a private person. Your privacy interests and the transparency and security interests of other people have to be balanced.</p>

<p>Now since you are not in Germany, the TMG does not apply to you. You have no legal obligation to provide this information. However, the ISP also has no legal obligation to to deliver your email. The ISP does have an obligation to apply appropriate organizational and technical safety measures. It seems that one organizational measure they have found appropriate is that they will only deliver emails from providers that provide public contact information, as would be the norm in Germany.</p>

<p>I am not entirely sure how the GDPR applies here. The GDPR doesn't really allow or prohibit disclosures of personal data, it just requires that every purpose of processing for personal data has a legal bases per GDPR Art 6.</p>

<ul>
<li>One such legal basis is a <em>legitimate interest</em>, which boils down to a balancing test between your rights and freedoms and other people's interests.</li>
<li>I'm also not sure if the contact information should be classified as personal data <em>in this context</em>, because the contact info primarily relates to your role as an email provider.</li>
<li>I'm also not sure if the ISP is processing your personal data in the sense of the GDPR when they merely require you to publish it on your own site. They would be processing it as soon as they scrape, store, or otherwise use this info.</li>
</ul>
