gdpr
GDPR treatment of a list of phone numbers
<p>How should a list of phone numbers be treated with respect to the GDPR?  Assume each number is a personal number and will go to an individual, but that there is no other information stored related to the individual.</p>

<p>Caution: I am not a lawyer.</p>

<p>It depends on who is doing the collecting and storing.</p>

<p>If it is done "by a natural person in the course of a purely personal or household activity", then it is exempt from the GDPR, as per <a href="https://gdpr-info.eu/art-2-gdpr/" rel="nofollow noreferrer">Art. 2</a>.</p>

<p>Beware, however, that "purely personal activity" means that you do not share or publish them. In <a href="http://curia.europa.eu/juris/document/document.jsf?docid=48382&amp;doclang=en" rel="nofollow noreferrer">this court case</a>, having the name or phone number of someone else on your "personal" website constitutes "processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of Directive 95/46".</p>

<p>Under the GDPR, <a href="https://gdpr-info.eu/issues/personal-data/" rel="nofollow noreferrer">phone numbers are just as personal information as is the name or adress</a> (emphasis mine):</p>
<blockquote>
<p>For example, the <strong>telephone</strong>, credit card or personnel <strong>number of a person</strong>, account data, number plate, appearance, customer number or address <strong>are</strong> all <strong>personal data</strong>.</p>
<p>[...]</p>
<p>Last but not least, the law states that the information for a personnel reference must refer to a natural person. In other words, data protection does not apply to information about legal entities such as corporations, foundations and institutions. For natural persons, on the other hand, protection begins and is extinguished with legal capacity. Basically, a person obtains this capacity with his birth, and loses it upon his death. Data must therefore be assignable to identified or identifiable living persons to be considered personal.</p>
</blockquote>
<hr />
<blockquote>
<p>For the purposes of <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">this Regulation</a>:</p>
<p>(1) ‘personal data’ means <strong>any information</strong> relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is <strong>one who can be identified</strong>, directly or <strong>indirectly</strong>, in particular by reference to an <strong>identifier such as a</strong> name, an identification <strong>number</strong>, <strong>location data</strong>, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, <strong>economic</strong>, cultural or social identity of that natural person;</p>
</blockquote>
<h2>Argumentation I</h2>
<p>Remember that phone numbers in the landline network contain location data (like the city of Kiel is +49-431-#, the city of Neumünster +49-4321-#). Cellphone numbers in the EU are provider coded (for example +49-176-# is Telefonica Germany), which can be used to identify an economic group from the average cost of the provider. Atop that, phone numbers are <strong>unique</strong>, making them by definition some kind of identification number, which is explicitly listed as automatically personal data.</p>
<p>Then, calling the number will most likely have the person talk, which allows identifying if one is talking to a male or female, some age estimate and maybe even the name. Or just enter a cellphone number in What'sApp and if they show up you might have even a picture.</p>
<p>By these virtues, a phone number can be used to indirectly identify a person, making a telephone number <strong>always</strong> personal data.</p>
<p>Without permission by the owner of the number you may <strong>not</strong> process it digitally in any capacity and even less sell it. Listing it somewhere (internet, book) where the public can access it, is clearly processing (and making it available for processing by others).</p>
<p>Under GDPR one needs explicit permission for processing, so yes, phone books need your permission to list your phone number.</p>
<h2>Argumentation II</h2>
<p>There is <a href="http://curia.europa.eu/juris/celex.jsf?celex=62014CJ0582&amp;lang1=en&amp;type=TXT&amp;ancre=" rel="nofollow noreferrer">ECLI:EU:C:2016:779</a>, in which a German court had requested clarification and the European Court decided that, if an IP address can be (sometimes together with a timestamp) used to identify that a specific person had this one at the given time, and this information is stored for proper billing, this information has to be personal data in the hands of the ISP. The court argues further that, since it is <strong>possible</strong> and <strong>legally possible</strong> for others to connect the IP with a person if they can get the ISP to do it for them (for example by having the police request such as they investigate a case), the IP is personal data even for these others. So, an IP is personal data to anyone that they have any legal means (for example by filing suit against <em>Anonymous with IP ##</em>) that could result in identification.</p>
<p>A telephone number is very much akin to a non-changing IP in that the Telephone provider is easily able to tell who has this number and has to do so for means of proper billing. As one could sue against <em>Anonymus with Phone number ##</em> (and have police investigate and fill the gap), a telephone number must be personal data, just like an IP.</p>
<hr />
<h2>more references (emphasis mine):</h2>
<ul>
<li><a href="https://security.stackexchange.com/q/188865">Security.SE: Is a standalone phone number considered Personally Identifiable Information?
</a></li>
</ul>
<blockquote>
<p>Could this number linked to a single person? [...]</p>
<p>Then yes. [...]</p>
<p>If you only have phone numbers without further information about them, you have to assume it is PII, because you don't know if a number belongs to an individual or not.</p>
</blockquote>
<ul>
<li><a href="https://www.gdpreu.org/the-regulation/key-concepts/personal-data/" rel="nofollow noreferrer">GDPR EU.org</a>:</li>
</ul>
<blockquote>
<p><strong>Any information</strong> these data controllers have on you, <strong>such as your</strong> date of birth, address, <strong>phone number</strong>, salary, and rent would therefore all <strong>constitute protected personal data under the GDPR</strong>.</p>
</blockquote>
<ul>
<li><a href="https://eugdprcompliant.com/personal-data/" rel="nofollow noreferrer">EU GPDR Complaint</a>:</li>
</ul>
<blockquote>
<p>CLASSICAL PERSONAL DATA</p>
<p>PHONE NUMBER</p>
<p>Your ID card, <strong>your phone number</strong>, your bank account, and your credit card number represent data that <strong>is unique to each person, therefore will lead to identification</strong>.</p>
</blockquote>
<ul>
<li><a href="https://www.itgovernance.eu/blog/en/the-gdpr-what-exactly-is-personal-data" rel="nofollow noreferrer">IT Governance European Blog</a></li>
</ul>
<blockquote>
<p>A brief guide what is (or could) be Personal Data</p>
<ul>
<li>Biographical information or current living situation, including dates of birth, Social Security numbers, <strong>phone numbers</strong> and email addresses.</li>
</ul>
</blockquote>
<ul>
<li><a href="https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en" rel="nofollow noreferrer">European Comission</a></li>
</ul>
<blockquote>
<p>Examples of personal data</p>
<ul>
<li>an Internet Protocol (IP) address;</li>
<li>the advertising identifier of your phone;</li>
</ul>
</blockquote>

<p>The current question does not contain enough information to properly answer it.</p>

<ul>
<li>I agree with <a href="https://law.stackexchange.com/a/38184/18215">Trish</a> that a phone number is personal data. That is also expressed in the question.</li>
<li>And there are situations where the GDPR does not apply, like a purely personal activity, as noted by <a href="https://law.stackexchange.com/a/38182/18215">danuker</a>.</li>
</ul>

<p>But it is important to know which phone numbers are on the list. </p>

<ul>
<li><p>If the list contains all existing phonenumbers in a country (like all numbers from 000000000 till 999999999), there is no problem at all processing it. Processing can be based on legitimate interests of the controller, and because the list contains all phonenumbers, it will not be overridden by the fundamental rights and freedoms of the data subjects. (Such a list expresses nothing special about an individual).</p></li>
<li><p>However if for example the list contains all phonenumbers of persons who donated to a particular church, <a href="https://gdpr-info.eu/art-9-gdpr/" rel="nofollow noreferrer">Art. 9</a> applies, which is very restricted.</p></li>
</ul>

<p>Most lists will probably be somewhere between those two extremes.</p>

<p>If the phone numbers on list are by definition not personal data, the GDPR would not apply. This could, for example, be the case if you compile a list of phone numbers used by telemarketing companies. But a phone number which is owned by a company, could still be personal data if it is used as a direct dial number of an individual.</p>

<p>If you don't have any information other than the telephone numbers, in your hands (being a data controller):</p>

<ol>
<li>you can't identify any living person from the telephone numbers alone, and</li>
<li>you're not going to get any any further information related to the phone numbers that allows you to identify a living person, </li>
</ol>

<p>the starting point is that it's not personal data. </p>

<p>But then if you were to start calling the owners of the numbers and asking them their names and associating that name with the telephone number, it would be. </p>

<p>See Recital 26 of the GDPR, third and fourth sentence.</p>

<p><strong>TL; DR</strong></p>

<p>Phone numbers that are personal data should be treated as such. Phone numbers that are not personal data (and there will be these, even if they go to an individual) do not need to be treated as personal data.</p>

<p><strong>Is an individual's phone number alone personal data?</strong></p>

<p>Regardless of how many sources tell you that a phone number is always personal data, should you be taken to the court the decision will be based on the GDPR definition and any relevant case law. The definition <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">goes</a>:</p>

<blockquote>
  <p>‘personal data’ means any information relating to an identified or
  identifiable natural person (‘data subject’); an identifiable natural
  person is one who can be identified, directly or indirectly, in
  particular by reference to an identifier such as a name, an
  identification number, location data, an online identifier...</p>
</blockquote>

<p>So, you have a phone number that goes to an individual. You do not know who he/she is yet. <a href="https://gdpr-info.eu/recitals/no-26/" rel="nofollow noreferrer">Can you identify?</a>:</p>

<blockquote>
  <p>To determine whether a natural person is identifiable, account should
  be taken of all the means reasonably likely to be used, such as
  singling out, either by the controller or by another person to
  identify the natural person directly or indirectly. To ascertain
  whether means are reasonably likely to be used to identify the natural
  person, account should be taken of all objective factors, such as the
  costs of and the amount of time required for identification, taking
  into consideration the available technology at the time of the
  processing and technological developments.</p>
</blockquote>

<p>Your options are:</p>

<ol>
<li>Search on the web, Yellow Pages etc. This may work.</li>
<li>Call the number and ask. This may work too depending on whether the phone is picked up by the owner and whether they are in the mood.</li>
<li>Ask the telco provider to reveal the identity of the owner. This will almost certainly not work.</li>
<li>Apply for a court order to get the telco provider reveal the identity. This will work if you win <em>and</em> the telco provider actually has the owner's details.</li>
</ol>

<p>Now, in some countries it is possible to buy prepaid SIM cards without providing any IDs. This means that phone numbers the owners of which cannot be identified by reasonable means (i.e. without hiring detectives/intelligent services etc.) <strong>do exist</strong>.</p>

<p><strong>And so what?</strong></p>

<p>For each number, unless you are sure the owner cannot be identified by reasonable means, treat it as personal data.</p>
