The CNIL explains that reconstructing professional email addresses from publicly available data must comply with the GDPR and can rely on legitimate interest only if specific conditions are met. Organizations must assess the visibility of the data, the expectations of the data subject, and implement safeguards such as limited retention and immediate exclusion upon objection. The guidance also notes that public administrations may rely on the public interest basis under article 6.1(e) of the GDPR.
Why it matters: Clarifies when legitimate interest can be used for email reconstruction, impacting B2B prospecting practices.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
