The CNIL explains that organisations may deduce a professional email address from publicly available information, but must comply with the GDPR and specific commercial prospecting rules. Data subjects must be informed clearly about the purpose and method of reconstruction and their rights to oppose, access, rectify, erase or limit the use of the reconstructed address. The guidance outlines the obligations of controllers and processors when handling such data.
Why it matters: The guidance clarifies GDPR‑compliant limits on reconstructing professional emails, reinforcing transparency and data‑subject rights.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
