It’s a well-known tactic among sales teams and marketing professionals. You know the decision-maker’s surname, their first name, and the company they work for. By looking at the usual email formatting used within that company, for example [email protected], it becomes child’s play to deduce their direct address, even if that address has never been publicly published on the Internet.
Yet, as the CNIL (Commission Nationale de l’Informatique et des Libertés) points out, the fact that information is accessible online does not mean it may be freely exploited. Reconstituting a professional email address constitutes a processing of personal data in its own right, subject to strict rules.
Between legitimate interest and respect for privacy
To justify this practice without needing prior consent, organizations typically rely on the notion of “legitimate interest” under the GDPR. But the CNIL warns that this legal basis is not a blank check. The company must demonstrably prove that its need to contact the person is real and that it does not excessively infringe on the recipient’s rights.
Everything hinges on what the professional can “reasonably expect” to receive. A person who is very active on professional networks or whose role entails being easily reachable will be more exposed.
Conversely, if a colleague has no identifiable online presence or has configured strict settings to hide their contact details or to prefer a contact form; the CNIL considers that they are clearly expressing a protective intention. In this scenario, reconstructing and using their email address becomes illegal, unless explicit consent has been obtained.
For administrations and public bodies, the framework is slightly different. Reconstitution can fall within their mission of public interest, but the protection requirements remain the same.
Essential safeguards and an immediate right of withdrawal
To prevent abuses, the CNIL recommends professionals implement rigorous safeguards. For example, if an email address is reconstructed but no actual contact is established within a reasonable timeframe, the data should not be retained.
Moreover, transparency remains a central obligation. From the very first message sent, the sender must clearly inform the recipient of the purpose of the outreach, how their address was obtained, and the means to object.
If the contacted professional expresses disagreement or requests to stop being contacted, the organization is required to remove their address from its prospecting files immediately, without asking for any justification.
Should the sender remain silent for more than a month or provide an unsatisfactory response, the recipient retains the right to file a complaint directly with the CNIL.
