French and Greek approach on the professional email addresses Is a professional email address –such as JohnNewton@Xstatehospital.com - personal data? Well, in France no, but in Greece yes. Section 13 of EU Directive 2002/58/CE governs the collection and use of email addresses. This directive was implemented in France in 2004 (Loi nº 2004-575 du 21 juin 2004) and also in Greece in 2006 (Law 3471/2006 art.11 section 3). Although a clear statement, such as that the professional email addresses are not personal data, does not exist in the directive; there is paragraph 5 which reads: “Article 13 Unsolicited communications 1. The use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may only be allowed in respect of subscribers who have given their prior consent…. 2. … 3. Paragraphs 1 and 3 shall apply to subscribers who are natural persons.” Under French law and based on a broad interpretation of the limitation to natural persons, the French Data Protection Agency (CNIL) ruled that a prior consent is not required in a Business to Business context. (see http://www.cnil.fr/la-cnil/actu-cnil/article/article/position-de-la-cnil... ). This professional context exception also appears in the FEDMA European Code of Practice (see attached in Pdf) in Paragraph 2.4 (page 6) and covers “persons clearly linked to their organization or company…” “2.4 Collection of Personal Data of Legal Persons related to business products or services Persons clearly linked to their organization or company can be contacted for Direct Marketing purposes for business-related products or services through electronic mail without their prior consent but only in the context of the position they hold in either the public or private sector – and without prejudice to an opt-in regime applicable under national laws. Such an electronic mail must contain in any case an unsubscribe facility by which the Data Subject can object to receiving future unsolicited commercial communications via the medium used or another medium. The webpage on which the collection takes place should clearly state the Data Subject’s right to object to every future commercial use of his/her Personal data for Direct Marketing both by the data collector as well as its intermediaries and inform the subject how to object to processing of electronic contact details.” So, although this professional context exception does not appear in the french law, it is the result of a broad interpretation of the French Data Protection Agency itself and the FEDMA European Code of Conduct. On the other hand Greek Data Protection Authority does not recognize such an exemption and considers the professional email addresses as personal data, the use of which requires Subject’s prior consent. The difference is quite obvious: You are free to send an email to e.g. JohnNewton@Xstatehospital.com in France, provided that you send professional information, but in Greece you cannot do so, unless you have John Newton’s prior consent. And the confusion gets bigger when corporations in both countries have to follow different guidelines for the collection and use of professional email addresses. In my opininon, although greek DPA is fully complied with the european directive and the greek law, the french way is better, more justified and it serves by far the neccessity of communication and information. After all, having no right to send professional information in professional email addresses without the Subjects’ prior consent is quite unorthodox.