GDPR - Estate Agent email

[samurl]

Allow me to correct you

GDPR is EU regulation that did not require EU member states to pass legislation to enact it. However, the UK intends to leave the EU and therefore enacted legislation equivalent to GDPR under the Data Protection Act 2018. See here for more details: http://www.legislation.gov.uk/ukpga/2018/12/contents/enacted

The UK will be a 'third country' once we leave the EU.

Oh I hear you! However as I understand it, under the new DPA laws (which are largely in line with GDPR), the rules are the same regarding sensitive personal data. You can take a look at that here: https://www.gov.uk/data-protection

So, are you saying that it is fine for the estate agents to disclose personal e-mail addresses (which could in every respect therefore disclose someones identity) in a bulk send-to regarding a plot of land for sale?

Maybe I'm missing something here, but I disagree.

 

[samurl]

e-mail addresses aren't themselves sensitive information, it's basically just incredibly unprofessional. Calm down and if the guy is that much of a muppet spend money elsewhere.

If your e-mail address is [email protected], then it fully identifies you as an individual to a third party. This is sensitive personal data, and needs to be handled as such.

 

[The_Abyss]

Oh I hear you! However as I understand it, under the new DPA laws (which are largely in line with GDPR), the rules are the same regarding sensitive personal data. You can take a look at that here: https://www.gov.uk/data-protection

So, are you saying that it is fine for the estate agents to disclose personal e-mail addresses (which could in every respect therefore disclose someones identity) in a bulk send-to regarding a plot of land for sale?

Maybe I'm missing something here, but I disagree.

I'm not saying that it is fine at all. What I'm saying is that people keep banging on about GDPR, and that's incorrect. The correct legislation governing these controls and laws is Data Protection, not GDPR. The Data Protection Act 2018 to be specific. So this is a breach of the DPA, not GDPR.

 

[NickK]

e-mail addresses aren't themselves sensitive information, it's basically just incredibly unprofessional. Calm down and if the guy is that much of a muppet spend money elsewhere.

Personally identifiable information - email is that in many cases, just as your phone number is. It's an odd one - that anything that can be used it identify someone - and often companies define that as a unique identifier such as a customer number too.

My place of work certainly see email address as PII.

GDPR means you need to actively seek and gain their approval before their PII can be used and for what purpose. So the individual would have to go to each of the individuals and seek their permission to send it to other estate agents for the purpose (yes that is needed too) and then send an email to each without being in a massive list.

 

[Raumarik]

Personally identifiable information - email is that in many cases, just as your phone number is. It's an odd one - that anything that can be used it identify someone - and often companies define that as a unique identifier such as a customer number too.

My place of work certainly see email address as PII.

GDPR means you need to actively seek and gain their approval before their PII can be used and for what purpose. So the individual would have to go to each of the individuals and seek their permission to send it to other estate agents for the purpose (yes that is needed too) and then send an email to each without being in a massive list.

it can be personal data but it's not usually considered sensitive, there is a difference and not all places always need consent to use your data eg NHS who can use public task or vital interest normally as justification.

if the mailing list was for mental health patients attending a clinic then that changes things dramatically etc.

 

[Raumarik]

An email address is PII (Personally identifiable information) however depending on the name of his email address might not directly identify your mate.

He could complain to the ICO but it is highly unlikely will he receive compensation from the estate agent.

I wrote sensitive, I did not write that it wasn't PII. They are different.