internet european-union business data-protection ireland
GPDR: Are third party companies alowed to track my e-mails
<p>I live in Ireland and I've been doing business with an Irish company. That company has using a third party for its main IT system and this system has been sending me e-mails.</p>
<p>Just recently I've had a problem with the original company who are claiming to have sent me details on some work that I don't remember receiving. Their response was to tell me the exact time and date (to the nearest second) when I opened the e-mail!</p>
<p>After doing a bit of analytics on other mails they sent me, I discovered the following:</p>
<pre><code>&lt;img src=&quot;http://third-party.company.com/wf/open?upn=unique-300-character-identifier&quot; alt=&quot;&quot; width=&quot;1&quot; height=&quot;1&quot; border=&quot;0&quot;&gt;
</code></pre>
<p>For non-tech people: what has happened here is that a unique image that is too small to be seen has been embedded in the mail message. When the e-mail is opened that image is downloaded from a remote server, which would have record the time and date the mail was opened.</p>
<p>I am really unhappy about being tracked.</p>
<p>From a legal POV:</p>
<ol>
<li>I've not consented to this</li>
<li>Can the third-party, which is based in the UK, collect this data</li>
<li>Can the third-party share it with a company in EU country</li>
<li>I can't see any legitimate business requirement that either company could have for tracking me.</li>
</ol>
<p>Legally, where do I stand.</p>

<p>It would seem to me that a company with which you are doing business has a legitimate reason to confirm that you did or did not receive their messages, just as they would be entitled to send you postal mail with a return receipt if they choose to. They already know the contents of the email, because they are either the sender or the receiver, so the only additional information the  tracking pixel gives them is the timestamp of your access to the email.</p>
<p>You could perhaps stop this by instructing your browser or other email program not to download images, or to prompt you for permission on each image.</p>
<p>Since the Irish company you are doing business with is in the EU (and you are also), the GDPR should apply. Thus they ought to have a lawful basis to process any personal data (PD) relating to you under GDPR <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6</a>. Under [Article 13], when a Data Controller (DC) obtains Personal Data (PD) from the data subject, it is supposed to notify the subject that it has done so, and provide certain information to the subject. Article 13 paragraph 1 states:</p>
<blockquote>
<p>Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:</p>
<ul>
<li>(a) the identity and the contact details of the controller and, where applicable, of the controller’s representative;</li>
<li>(b) the contact details of the data protection officer, where applicable;</li>
<li>(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;</li>
<li>(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;</li>
<li>(e) the recipients or categories of recipients of the personal data, if any;</li>
<li>(f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.</li>
</ul>
</blockquote>
<p>Article 13 paragraph 2 states:</p>
<blockquote>
<p>In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:</p>
</blockquote>
<blockquote>
<ul>
<li>(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;</li>
<li>(b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;</li>
<li>(c) where the processing is based on point (a) of Article 9(2) [consent], the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;</li>
<li>(d) the right to lodge a complaint with a supervisory authority;</li>
<li>(e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;</li>
<li>(f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.</li>
</ul>
</blockquote>
<p>Note that the DC need not provide this information if the DS already has it. It might be buried in a long ToS document or privacy policy.</p>
<p>There is a somewhat similar set of information, albeit different in detail,  to be provided under <a href="https://gdpr-info.eu/art-14-gdpr/" rel="nofollow noreferrer">Article 14</a> when the DC obtains PD from a third party. The obligation under article 14  does not apply when the DS already has the information, when it is impossible or unreasonably hard to comply, or in any of several other conditions.</p>
<p>You could request of the Irish DC that they supply you with the information required under article 13 or 14. You could make the same request of the &quot;third party company&quot; but they are probably acting as a Data Processor (DP) in which case the obligation is on the DC.</p>
<p>You could also make a data access request under <a href="https://gdpr-info.eu/art-15-gdpr/" rel="nofollow noreferrer">Article 15</a> winch states:</p>
<blockquote>
<p>The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:</p>
</blockquote>
<p>This is followed by a list of the details to be provided by the DC.</p>
<blockquote>
<ol start="2">
<li>Can the third-party, which is based in the UK, collect this data</li>
</ol>
</blockquote>
<p>If the third-party is acting as a Data Processor, in accordance with a contract with the DC, they have to same right to collect the information as the DC would have if the DC did this directly, and must abide by the same restrictions, They may share this data with the DC, and with others only at the DC's direction, for which direction the DC is responsible.</p>
<p>Under <a href="https://gdpr-info.eu/art-27-gdpr/" rel="nofollow noreferrer">article 27</a> a Processor not established in the EU must appoint a representative within the EU to with requests and complaints may be addressed. If the data begin processed does not include &quot;special&quot; data (mostly Personally Identifiable Information) &quot; and is unlikely to result in a risk to the rights and freedoms of natural persons&quot; no representative is required. You are entitled to request the contact info of the representative. (A DC not in the EU must also have a representative.)</p>
<blockquote>
<ol start="3">
<li>Can the third-party share it with a company in EU country</li>
</ol>
</blockquote>
<p>Under [Article 44] transfers to counties outside the EU are restricted:</p>
<blockquote>
<p>Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. 2All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.</p>
</blockquote>
<p>Articles 45 thru 50 specify the specific situations under whch such transfers are lawful. Under article 13(1) (f) the DS should be informed of any intention to make such a transfer when the data is collected.</p>
<blockquote>
<p>I [can't] see any legitimate business requirement that either company could have for tracking me.</p>
</blockquote>
<p>As I mentioned above, knowing whether and when you read a communication is probably legitimate. Additional tracking might not be.  I can find no law or regulation prohibiting such tracking,. but the results are surely PD subject to the GDPR and all its applicable provisions.</p>
<blockquote>
<p>Legally, where do I stand?</p>
</blockquote>
<p>It seems that the Irish Company may have violated the GDPR (arts 13 or 14) by not informing you of the information collected. You could request that info, and also access to all PD they have about you under art 15 (linked above). The relevant supervisory authority in Ireland is the <a href="https://www.dataprotection.ie/" rel="nofollow noreferrer"> Data Protection Commission</a>. Further relevant information is available on the DPC site, and that is where a complaint could be made.</p>
<p>The GDPR does not, in  most cases, give a DS a personal right to sue a DC. on the page <a href="https://www.dataprotection.ie/en/individuals/exercising-your-rights/raising-concern-commission" rel="nofollow noreferrer">&quot;Raising a concern with the commission&quot;</a>_ the DPC writes:</p>
<blockquote>
<p>In today’s business world most organisations take data protection very seriously, and the majority of issues are resolved without ever needing to raise a conern [<em>sic</em>] with the DPC. However, if you have contacted an organisation about a personal data concern, in keeping with the guidance provided in our ‘Know Your Rights’ section and you are unhappy with the outcome, you can raise the matter with the Data Protection Commission through our online form.</p>
</blockquote>
