We’ve been contacted by one of our clients who wanted to know if they could send electronic marketing to a company email address without consent… Here’s what we told them:

The Client

Our client, in this case, is the marketing manager for a financial services organisation.  They offer products and services to consumers and businesses and are always looking for new ways to get their message out.

The Situation

Our client called the Helpdesk to ask us whether it would be considered compliant to send marketing emails to a list of email addresses they had even though they didn’t have consent to send marketing to those email addresses.
He thought that it would be acceptable because the email addresses were professional email addresses that people used for business purposes because that’s what he’d heard form one of his contacts who also works in marketing.
They felt that because the email address was for business purposes and not someone’s personal email address it didn’t fall under the scope of data protection regulations.

What do the rules say?

From a business point of view you may view a persons’ email address as B2B data, but the legality of it is that a corporate email address that contains a person’s name is classed a personal data.

Data protection regulations specifically and clearly state that a name is covered by the regulations and it has no exception saying that the name is no longer covered if it forms part of an email address, wether used for personal or business purposes.

In the UK, The regulator themselves share this view.  This is a direct quote for guidance published by the UK Information Commissioners Office (ICO):

“consider data protection implications if you are emailing employees at a corporate body who have personal corporate email addresses (eg firstname.lastname@org.co.uk)”.

So it’s pretty clear that a name, even when it forms part of a corporate / business email address does fall under the scope of all relevant data protection regulations.

In Summary

A name is a name, it doesn’t matter how that name appears or in what form it is still a name and must be protected under data protection regulations.

It may be that there are other considerations which could be taken into account to enable email campaigns, but those are considerations of a lawful basis nature and not over whether the name is in scope or out. It’s definitely in!