Surprise: Not all personal data is protected by the GDPR!

“Work email addresses don’t count as personal data, right?” We’ve heard this a lot recently. The simple answer is that individuals’ work email addresses are personal data. If you are able to identify an individual either directly or indirectly (even in a professional capacity), then GDPR will apply. https://www.cognitivelaw.co.uk/gdpr-issues-do-work-emails-count-as-personal-data/

Interesting thought. The interpretation in your text seems to be at odds with the core definition of personal data (Article 4 (1)), though. In their Opinion 4/2007 , WP29 set out four "building blocks" that can help identify what comprises personal data The building blocks are as follows: 'any information', 'relating to', 'an identified or identifiable', 'natural person'. Now, given that, the content of personal data includes any sort of information, and it is not limited to information that refers to a narrow interpretation of the individual's private and family life. Additionally, the CJEU established that the concept of private and family life must be widely interpreted (Amann vs Switzerland 2000-02-12). Consequently, personal data includes information about an individual's private life and information regarding any activity undertaken by that individual. My understanding is therefore that this activity may relate to activities in the professional and public sphere as much as in an individual's private life. Conclusively, an individual's contact information at their place of work will be personal data in the same way as their home address or personal phone number and is subject to the Regulation. Despite the above, I find your analysis reasonable and would appreciate perhaps a comment on Recital 14 from the EDPB. It is interesting to know what the regulators were aiming at.

Enligt sk?ll 10 GDPR s? har Sverige r?tt att utvidga och precisera begreppet personuppgift. I det perspektivet s? kan det vara av intresse att Svea hovr?tt har ansett att registreringsnumret f?r en enskild firma, vilket inneh?ller personnumret f?r den som st?r bakom firman, utg?r en personuppgift, (dom 2004-08-31 i m?l nr B 4151–04).

S? h?r har man tidigare resonerat. "Information om juridiska personer kan ocks? fr?n fall till fall anses ”avse” fysiska personer i enlighet med kriterierna i detta dokument. Detta kan vara fallet n?r namnet p? en juridisk person h?rr?r fr?n namnet p? en fysisk person. Ett annat fall kan vara f?retags-epost, som vanligen anv?nds av en viss anst?lld, eller information om ett litet f?retag (r?ttsligt sett snarare ett ”objekt” ?n en juridisk person), som beskriver sin ?gares beteende. I alla dessa fall, d?r kriterierna ”inneh?ll”, ”syfte” eller ”resultat” g?r att informationen om den juridiska personen eller f?retaget anses ”avse” en fysisk person, b?r informationen anses som personuppgifter och uppgiftsskyddsbest?mmelserna g?lla" https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2007/wp136_sv.pdf

I would offer a completely different interpretation of recital 14. 1)?????Setting the context – only natural persons? Here there should be no disagreement. GDPR only applies to natural persons. Natural persons has to be alive, or they would not be natural persons. 2)?????Delimiting the scope – not personal data concerning legal persons This is just a refinement of an obvious conclusion arising from the fact that GDPR only applies to natural persons. If it only applies to natural persons it can’t apply to legal persons as they are mutually exclusive. The date of incorporation, the form, bylaws as well as the financial standing of a legal person clearly is not information about a natural person unless processed in a specific context. There are the situations in which the same information can concern both a legal and a natural person, but then the GDPR would apply on the basis of the information does concern a natural person.? 3)?????Articulating the scope of delimitation to include “undertakings”? Here it becomes interesting. Undertaking is a term precisely defined by the CJEU. The case C-74/16 (Congregación de Escuelas Pías Provincia Betania v Ayuntamiento de Getafe) offers us a re-stated definition of “undertaking” as?“covers any entity engaged in an economic activity, regardless of its legal status and the way in which it is financed”.?This definition tells us that undertakings a simply the organizational form of any economic activity and not the economic activity as such. To provide extra support for this conclusion I would offer you C-41/90 (H?fner and Elser v Mactrotron GmbH),?“the concept of an undertaking?encompasses every entity?engaged in an economic activity”. Now let’s consider this sentence from recital 14 with this in mind. As discussed above, it is clear that legal persons are excluded from the protection of the GDPR. Now the sentence reads “… and in particular undertakings established as legal persons…”. Even a standard (non-legal) interpretation would offer that this part is simply a refinement of what came before, the term “legal person”. If you add to that, the concept of undertaking as the entity that is engaged in economic activity rather than the economic activity itself then it is clear that the intent was never to remove the day-to-day activities of legal person (or undertaking) from the material scope of the GDPR. 4)?????Exemplifying e.g. contact details. The only take away from this part is that the name, form and contact details of the legal person is excluded from the GDPR. This should be obvious as we have concluded above that legal persons are not within the material scope of the GDPR. Is the e-mail address of an employee the contact details of the legal person? Obviously not, the contact details of the legal persons are the contact details to the legal person itself, i e “GDPR LLC, PRIVACY STREET 1, CITY OF ENCRYPTION”. Now that we have considered the entire recital 14 and reached the complete opposite conclusion, I would argue that my explanation is more coherent with the Charter of fundamental rights, concepts defined by EU-law as well as the rest of the regulation itself. And thus, details about individuals engaged in the activities of a legal person (or undertaking) is within the material scope of the GDPR, including e-mail addresses.