In practice, it is very common for data controllers to wonder if they can process company information, such as, for example, the contact telephone number or email of the owner, without having expressly obtained consent.
In relation to this issue, recital 14 of the General Data Protection Regulation (GDPR) tells us that: “This Regulation does not regulate the processing of personal data relating to legal persons and in particular to companies established as legal persons, including the name and form of the legal person and its contact details.
Therefore, we assume that, in the processing of company data, the RGPD does not apply; but the regulations that regulate the sending of communications, whether between companies or with individuals, is Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSICE).
However, the question goes further. Doubt appears when It is intended to process data of people who work in a company. In this case, it is no longer the tax address but the contact telephone number of the person responsible for the company, for example. To resolve this doubt, we must go to Organic Law 3/2018, on Data Protection and Guarantee of Digital Rights (LOPDGDD), specifically, its article 19 which tells us that; “Unless proven otherwise, will be presumed to be covered by the provisions of article 6.1.f) of the RGPD (legitimate interest of the data controller) the processing of contact data and, where applicable, those related to the function or position held by natural persons who provide services in a legal entity provided that the following requirements are met:
- That the treatment refers only to the data necessary for your professional location.
- That the purpose of the treatment is solely to maintain relationships of any kind with the legal entity in which the affected party provides their services.
Finally, it is worth asking:What happens with professionals and self-employed people? who sometimes share the same phone for professional and private use? Well, the same presumption will operate for the processing of data relating to individual business people and liberal professionals, as long as they refer to them only in that capacity and are not processed to establish a relationship with said people as natural persons.
