GDPR Disclaimer On Cold Call Emails I live in the United States. I am helping someone who just started an online store selling tee shirts. In my research to come up with a plan regarding cold call email marketing, I came across GDPR. Her target market is the US, but she is not opposed to selling to anyone in the EU either. She wants to send advertisements via email to potential customers to introduce her store. In reading about GDPR, I understand the fines can be astronomical for contacting someone who is a citizen of a country governed by GDPR. That is the scenario, here are my questions: If her intent is to market to US based customers only and has a disclaimer on the ad, will that protect her from violating GDPR? Her disclaimer would look something like this: &quot;GDPR Disclaimer - This advertisement is intended to introduce potential US based customers to XYZ company...yada yada yada. If you have received this email and if you reside in a country controlled by the GDPR law, this email was not intended for you and was sent to you in error. There is nothing you have to do, you are not subscribed on any list and you will not receive any further contact&quot;. She has obtained a list of hundreds email addresses from the internet. She has no idea who owns a given email address nor what country they reside in. Cold calling (not spamming) is allowed here in the United States. The fact that GDPR strongly discourages it (or outlaws it...not really sure which one when it comes to GDPR) should not preclude her from trying to reach potential customers in her own country. There are some domain extensions she would avoid entirely (such as &quot;de&quot; for Germany) as she would have the assumption any email in that domain would be for Germany and thus controlled by GDPR. Other domains are not that clear cut. The &quot;com&quot; domain is mainly US commercial, but &quot;gmail.com&quot; is a email provider which is global. How can I know if a given email address (for instance &quot;jsmith@gmail.com&quot; is for a person in the United States, Europe, Australia, Japan or wherever? &quot;jsmith&quot; doesn't even really have to belong to someone with a first initial of &quot;j&quot; and a last name of &quot;smith&quot;. It could be an alias for someone else. My point and my question is this. My friend doesn't want to violate GDPR, but at the same time she doesn't want to be precluded from marketing to potential customers in the US. How does she know if an email address is controlled by GDPR. It seems to me that there would have to be a way to know this or it cannot be enforced up to the point when it is discovered. Does this make sense? Is there any repository (online database) that would tell me is a given email address is owned by person who is in a country that is controlled by GDPR? It seems to me that there should be. She should be able to comply with the law by submitting her (say 500) list of email addresses in a query to a GDPR database and it kicking back the 20 or 30 addresses that are protected. In that way, she knows who she can market to and who she can't. As I understand it, there is no such repository so she has to guess which email addresses she can use and which she cannot. That is really unfair and it would essentially block her from reaching out to her intended audience out of fear she should send to someone in a GDPR protected country without intending to or knowing it.
That GDPR Disclaimer is no protection in some jurisdictions: the applicable laws to that situation in germany for example don't care about the GDPR: Cold calling, mailing, or e-mailing private people to advertise services all is handled by the same law: Without the consent it is expressly illegal under §7 of the law against unfair competition (Gesetz gegen unlauteren Wettbewerb UWG) and such cases are rather Slam-Dunk if the origin can be made out. The punishment can be a 300.000 € fine. The fact that to email someone you need their e-mail address and that e-mail addresses and private addresses are by default considered personally identifiable information is making it worse for the advertizer: Without either an exception (there is none available to cold-emailing) or special allowance of the person the data belongs to, you violate §4 of the federal data protection law (Bundesdatenschutzgesetzes BDSG) just by handling their e-mail address. That's a separate crime from the UWG one, adding up to another 300.000 € fine under §43 BDSG - or even up to 2 years in prison under §44 BDSG! Oh, and if the email does not contain a proper sender's address, that's another chance for a huge fine under the UWG... So, GDPR is your least trouble, if you violate the marketing laws of a country, or their own data privacy laws. A disclaimer means nothing as the act of sending the mail, even to an unintended addressee, is what is illegal and the law as written does not give a damn about 'I didn't want to advertise to that person' when in fact you sent them unwanted advertisements. Oh, and the very repository you suggest? It would violate the very same §4 BDSG and be illegal for processing private data if it was not actively asked to do that by the end user. As a result, that database is useless: It does kick back all people not in its database. Its database is incomplete because only few people give their address to that database as people not aware of the database never add their data on their own. So it regularly violates §4 BDSG with every German citizen's e-mail address it gets and kicks back, and claiming those addresses would be OK, it throws the company trying to check the database under the bus because they rely on data that is impossible to be reliable. tl;dr Don't do cold-(e)-mail marketing. You throw yourself into boiling oil with a lit torch in hand. further reading Other laws banning such behavior I had listed here, and I quote myself: The US has the CAN-SPAM-Act, which illegalizes sending unsocialised advertisements. You may NOT send a mail if any of the following is true: it has no opt-out the email was gained by 'harvesting' contains a header not matching the text contains less than one sentence the adressee does not have any relation to you In fact, you are liable for a 5-digit fine per infringing e-mail in the US. The FTC itself suggests to never buy e-mail lists - as E-mail harvesting or generating any possible e-mail adress itself is illegal.
Personal data is any information relating to an identifiable person, whether that information is public or not. The student website is definitely processing personal data of faculty. Any website is also necessarily processing personal data of visitors due to technical reasons, even though hosting has been outsourced to a third party. There's always a server, you just might not be managing it yourself. Thus, GDPR applies. Just because it processes personal data doesn't mean that the student website would be illegal. It just means the students are responsible for GDPR compliance of that website. Since the website is controlled by students and not by the university, the university DPO has no say here and the university can't demand the website to be hosted in a particular manner. Nevertheless, the DPO's suggestions might be quite sensible. Typical GDPR compliance steps include: having a clear purpose for which the personal data is being processed having a legal basis for that processing (here, probably a “legitimate interest” which will require a balancing test), see Art 6 providing transparent information to the data subjects providing a privacy notice to website visitors, see Art 13 notifying faculty per the requirements in Art 14 GDPR preparing to fulfill data subject rights such as access, rectification, and erasure when using a legitimate interest, there's also a right to “object” (opt-out) implementing appropriate technical and organizational measures to ensure security and compliance of your processing activities, see Art 24+32 making sure that third parties to which you outsource processing activities are contractually bound as “data processors” to only use the data as instructed by you, see Art 28 if you transfer data to non-European countries, having appropriate safeguards in place Does this sound complicated? It can be complicated. The point is that the internet is no longer the lawless Wild West. Just because you can easily publish a site with personal data, doesn't mean that you should. The GDPR is about requiring data controllers to find an appropriate balance with the rights and interests of the affected persons. Of course there are countries with less regulation, but there are also countries with fewer taxes and that isn't necessarily good for society. The easiest way to avoid these responsibilities will be to stop publishing the site as students – and instead taking up the university DPO's offer to have the university run the site. Which is less fun, of course, but the adult thing to do. If this motivates you further: note that the data controller (the people responsible for the site) must publish their contact information in the privacy notice, typically name + email + street address. The GDPR contains no exceptions that would help here. There is an exception for purely personal or household activities. But if the website would be available to the general public, it would be difficult to argue that this is purely personal. There's also case law such as the Lindqvist case requiring a narrow interpretation of that exception. In Art 9, the GDPR does mention that some restrictions are lifted if the data subject made the information public themselves. But that isn't relevant here, because Art 9 is only about extra-protected sensitive data, e.g. health information, union membership, or sexual orientation.
If person A deletes their account would that mean that person B no longer can view the email sent by person A? No. Person B's inbox implies overriding legitimate grounds that limit person A's &quot;right to be forgotten&quot;. See article 17.1.(c) of the GDPR. Furthermore, item 2 of article 17 is not applicable because the email service did not make A's personal data public. The email service merely sent to B the record with which A unequivocally addressed B. This means that the email service does not even need to notify B regarding A's request for erasure. All the email service needs to do is remove A's account pursuant to A's request.
Canada's anti-spam legislation (CASL)1 at the time was more strict than the regulations in other countries (e.g. CAN-SPAM Act in the U.S.). Notably, it applied to all emails sent to people in Canada, including those sent from other countries (of course, likelihood of enforcement is another issue). In general, a commercial electronic message can only be sent to users with their consent (express consent to receive messages, or implied consent through e.g. club membership or existing business relationships). Additionally, receivers must be able to unsubscribe or opt out. What part is mandatory? It is not mandatory in the sense it is required by law. But rather Microsoft considers that the communication is essential to its service provided to the user. If you want to opt out this kind of communication, Microsoft is signaling that it can/will end the customer relationship, that is, the only way user can opt out is to stop using the relevant service. The term &quot;mandatory service communication&quot; is and was used in Microsoft's Privacy Statement and other relevant user agreements Your communications preferences You can choose whether you wish to receive promotional communications from Microsoft by email, SMS, physical mail, and telephone. If you receive promotional email or SMS messages from us and would like to opt out, you can do so by following the directions in that message. You can also make choices about the receipt of promotional emails, telephone calls, and post by signing in with your personal Microsoft account, and viewing your communication permissions where you can update contact information, manage Microsoft-wide contact preferences, opt out of email subscriptions and choose whether to share your contact information with Microsoft partners. If you do not have a personal Microsoft account, you can manage your Microsoft email contact preferences by using this web form. These choices do not apply to mandatory service communications that are part of certain Microsoft products, programmes, activities or to surveys or other informational communications that have their own unsubscribe method. https://privacy.microsoft.com/en-CA/privacystatement CASL does not require the sender to signal if it's necessary to its contract or not, but it does require the sender to identify the opting-out mechanism. In this case, the statement informs the user that this particular communication is integral to its service and cannot be opt out separately from the service. Unlike the later European GDPR where a necessity test is used, CASL does not have this requirement and the contractual parties can define if a communication is integral as they want by means of express consent via user agreements (subject to other federal and provincial data protection rules). Or its really long long title: An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act
Update: On 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that cookies require explicit consent regardless of personal data is being processed. (Where the exceptions don't apply). (paragraphs 68-70 of the ruling). That does probably invalidate my answer below. However, because I have based my answer on information provided by the Dutch DPA, I will not update my answer until that DPA has responded on this. Basically, your thoughts are all correct. The Dutch DPA (Autoriteit Persoonsgegevens) has written a manual how to use Google Analytics compliant with the GDPR without having to ask for consent. But unfortunately it is not available in English. Based on Art. 28 GDPR, you need a Data Processing Amendment with google. Open the settings menu from Google Analytics Go to Admin Choose Account Settings Scroll down to the data processing amendment Open it Accept it Click Save Anonymize your visitors IP Address. A full IP address is considered personal data. It is possible to remove the last octet before it is processed by google. Add { ‘anonymize_ip’: true } to the tracking code on your website Create a screenshot of the change, so you can prove later at which date you made this change. Disable Data Sharing with google. By default Google uses the data for 5 different purposes. Each of them would require consent from the visitor of your website. So you need to switch that off. Open the settings menu from Google Analytics Go to Admin Choose Account Settings Scroll down to the data sharing settings Uncheck all checkboxes (Google producs &amp; services, Benchmarking, Technical support, Account specialists and access for sales experts) Click Save Disable Data Collection for Advertising. This has to be disabled at a different location, for the same reason as the previous step. Open the settings menu from Google Analytics Choose Property settings Choose Tracking info Choose Data collection Turn off these two options (remarketing and advertising reporting) Click Save Disable the User-ID feature. This is probably turned off by default. But it is important to keep it turned off. So you need to verify this. Open the settings menu from Google Analytics Choose Property settings Choose Trackinginfo Choose User-ID Disable it Click Save Even though you don't need consent to use Google Analytics, you still need to inform your users, for example by adding a few lines to your privacy policy explaining: You are using Google Analytics cookies. You have a data processing agreement with google. You have enabled IP anonymization/masking. You have disabled data sharing. You are not using any other google services in combination with Google Analytics. The Autoriteit Persoonsgegevens still recommends to offer an opt-out for Google Analytics, but it would not be required. As the Autoriteit Persoonsgegevens is a DPA as defined in chapter 6 of the GDPR, you have to assume their advice really is GDPR complaint. In the past they also had performed other investigations to the privacy policies of google.
The GDPR is about "processing" not "storing", so your actions definitely fall under the GDPR. Also you have stored the email address and the email you sent in your "Sent" folder. You need to reply with all the information you have associated with that email address. This will at least be the email you already sent. If you scraped the email address from GitHub then you have it in a table with (presumably) other information such as the repository where you found it, in which case send that row of the table with the associated column headers. If you really just have a list of email addresses then say so. If you merely saw the email address and then typed a fresh email then say so.
There are a number of misconceptions here. GDPR does not generally impose blanket bans, but things get dicey if you're using data in a way that is not strictly necessary. Consent (freely given opt-in) is a way to continue nevertheless. A website without ads, tracking, or potentially tracking embedded content can probably work without having to ask for consent. Under the GDPR, every processing of personal data needs a purpose. This purpose must be covered by a legal basis. Some processing might be legally mandated or required by a contract with the data subject. It's also possible to base processing on a legitimate interest, but this requires a balancing test that also considers the data subject's rights and interests. As a last resort, consent can be an appropriate legal basis, but this comes with additional restrictions. Once you have a clear purpose that is covered by a legal basis, you can process the minimum data necessary to achieve the purpose. Sometimes, laws prescribe a particular legal basis. This is the case for cookies. You can use cookies (and similar technologies that access information on the end user's device) as strictly necessary to provide a service explicitly requested by the user. If you go beyond that, the ePrivacy Directive says you must obtain consent first. So for example, session cookies, shopping carts, or cookies that remember a “dark mode” preference are all perfectly fine because they are strictly necessary for something the user is trying to do. Also, you can use cookies to remember if the user gave or declined consent. On the other hand, analytics or tracking cookies are not necessary and require consent. If a website embeds third party content, this discloses personal data such as IP addresses to the third party. This disclosure requires a legal basis, most likely consent. There is case law about this regarding Facebook Like buttons on a page (→ Fashion ID case) but the same principle can be generalized to embedded Tweets or Youtube videos, images, or JavaScript files. A common way to handle this is to replace the embedded content with a placeholder, and to only load the embed once the user gives consent. But not all other domains or services are “third party” in the sense of the GDPR. When you engage a company to act as a data processor on your behalf, they are contractually bound to only use the data as instructed by you, and not for their own purposes. The GDPR allows you to outsource processing activities such as serving web content, as long as you have a suitable contract in place. Such “data processing agreements” are common for hosting providers or CDNs. When consent is to be used as a legal basis, it's important to consider the various conditions that the GDPR imposes (see Art 7 GDPR). The core principle is that consent must be freely given. You cannot make access to a site conditional on consent, so a naïve cookie wall or captive portal will be non-compliant. It's fine to force a choice, but “no” MUST be valid and possible. That consent is freely given also means that you must provide enough context for the user to make an informed decision, that the user must give consent through an unambiguous, affirmative action (consent is never the default), and that consent must be specific for a particular purpose (you can't bundle unrelated purposes). That is why modern consent management tools have multiple layers of information and allow the user to give consent for individual purposes (e.g. yes to analytics but no to ad personalization). In your particular context, you could proceed as follows: Figure out what kind of external content you're currently including. Can you enter into a data processing agreement with the external providers? If so, sign that. Can you host the content locally? This can be an easy solution except for video streams. Careful: copyright concerns might make this impossible. Can you replace the content with placeholders that only load if and when the user gives consent? That way, the rest of your site remains accessible without annoying consent walls. If the third party content is an unavoidable and essential part of your page, use an interstitial to inform the user of the risks before they proceed.
Yes If you are in the EU, or your players are in the EU and your service is targeted at some part of (or all of) the EU, then this pretty clearly falls within the scope of the GDPR. Such a service would be collecting data associated with natural persons. At least some of it would be made public along with an online identifier, and other parts would be processed and stored, even if disclosed only in anonymized form. (By the way it is a non-trivial task to anonymize data well enough that it is no longer persona data under the GDPR. But let's suppose yoru methods are good enough.) Under GDPR Article 6 the DC must have a lawful basis for such processing. If the basis is &quot;consent&quot; then the consent must be freely given, whch means giving consent may not be a condition of using the service. Under GDPR Article 13 a notice must be sent to the Data Subject (DS) when the data is collected from the subject, including some 11 items or categories of information about the collection process, the Data Controller (DC), the purposes of processing, the legal basis of processing (which the DC must define), who will receive the data, the data retention period, and various rights of the DS. Such a service must be prepared to respond to data access and data erasure requests, under articles 15-17, and data restriction requests under article 18. It must provide a method for a DS to easily make such requests. Other GDPR provisions may well apply in addition to these, but that is enough to show that such service is very likely to be within the scope of the GDPR, unless none of the DSs are present in the EU or the related market area.