The Scraped Contact Database: Legitimate Interests Under Pressure
Lumen Analytics is an Irish B2B software vendor. Marketing wants to do three things: build a database of 40,000 business contacts by scraping publicly viewable professional profiles and company websites; enrich that database with a purchased list that flags 'wellness interests'; and run cold email campaigns to the resulting addresses. About 1,500 of the addresses belong to sole traders and partnerships. Sales representatives also maintain a free-text notes field in the CRM, and a sample review found entries such as 'off sick, chemo until March' and 'do not call - pregnant'. There is no budget for a consent-collection campaign. Marketing's position is that 'GDPR is about consumers, not businesses', so legitimate interests will carry the whole plan.
1. Can Lumen rely on Article 6(1)(f) legitimate interests for the scraped and purchased contact data? Set out what the balancing exercise requires and where it is likely to fail.
Read the worked answer
Partially - and the 'businesses, not consumers' premise is only half right.
Article 6(1)(f) requires a documented three-part legitimate interests assessment:
- Interest: direct B2B marketing can be a legitimate interest, but it must be real and present, not speculative.
- Necessity: is a smaller dataset or a less intrusive channel adequate? Scraping 40,000 profiles when a few thousand accounts drive revenue will fail the necessity limb.
- Balancing: role-based contact details of professionals carry lower expectations than personal data, but expectations are not zero. Relevant factors are the source of the data, the prior relationship, the safeguards applied, and the absolute Article 21(2) right to object to direct marketing, which must be offered in every message.
Where the theory breaks down:
- The 1,500 sole traders and partnerships are individuals - 'it is a business list' is no answer, and the ePrivacy marketing rules bite harder.
- The purchased 'wellness interest' flag is really an inference about health, importing Article 9 and an accuracy problem under Article 5(1)(d).
- Lumen has no evidence about the expectations of the source population, because it has never been in contact with them.
A defensible outcome is Article 6(1)(f) for corporate role-based addresses with strong safeguards and a visible opt-out, but not for the wellness flags or the sole traders.
2. What transparency obligations arise from the fact that the data were not obtained from the individuals, and how workable are they?
Read the worked answer
Article 14 is the weakest point in the plan.
Because the data are not obtained from the individuals, Lumen must still provide the Article 14(1) and (2) information: controller identity, purposes, legal basis, the legitimate interest relied on, recipients, any transfers, retention, data subject rights, the right to object, the source of the data, and any automated decision-making. Article 14(3) sets the timing: within a reasonable period and at the latest within one month, or at the first communication with the person, or on first disclosure - whichever comes first.
The Article 14(5)(b) 'disproportionate effort' exemption is available in principle but is applied narrowly. A workable approach for a B2B list is a prominent public privacy notice plus a clear link in each first email. What is not acceptable is silence until somebody complains.
Separately, Article 13 of Directive 2002/58 as transposed in Ireland governs the sending of the message, not merely the processing. Unsolicited electronic marketing to individuals needs prior consent, and the soft opt-in is limited to existing customers in the context of a sale. A company domain does not automatically remove that requirement, and certainly does not for sole traders. This calls for a per-recipient check, not a single legal theory applied to the whole list.
3. How should Lumen handle the free-text CRM notes field?
Read the worked answer
The notes field is the most serious exposure and should be remediated first.
A free-text field in which staff record 'chemo until March' will contain Article 9 health data. No Article 9(2) condition fits casual sales notes: there is no explicit consent from the data subject for this purpose, no legal claims, and no public interest basis in the vendor's own law. The processing fails Article 9, and independently fails Article 5(1)(c) minimisation and Article 25 data protection by design.
Practical steps:
- Disable or restructure the field so only structured, non-special-category flags can be recorded;
- Purge existing free-text content and consider erasure of the records;
- Brief sales staff and document the decision in the accountability record;
- Include CRM free-text in the next audit cycle.
One nuance: a 'do not call' suppression flag is legitimate and expected. Retaining the minimum needed to honour an Article 21(2) objection is compatible with the GDPR and is what supervisory authorities want to see. The point is to record a suppression, not a medical history.