Does GDPR make a distinction between individual and company email addresses?

Question

For a B2B company, does GDPR make a distinction in the level of consent required for sending marketing emails to individual and business email addresses? What about role-based emails at companies?

At a recent training course, it was advised that business email addresses (eg @companyname.com) were ok to send marketing emails to without explicit consent as long as the service/offering was related to their area of business (and that emails pertaining to individuals eg @gmail.com would still require explicit consent) - is this the case?

Note: I can find nothing online which supports this (and certainly at least one article which states that there is no difference between individuals and named people at companies). Plus, it just doesn't feel like good practice.

Answer 1

It is difficult to discern what a business email address is vs a private email address. The GDPR is about privacy and unwanted marketing.

If you're sending out marketing to business email addresses that was not requested, you do risk being punished by the new GDPR law in the EU.

People are speculating that the GDPR law doesn't have a lot of specifics and that it just has a general guideline of acceptable business practice. From what I gather, this entails not sending out unwanted marketing in the form of spam to people. I believe that involves not being able to send marketing email to business addresses that is unrequested.

You need to have consent for the EU citizen to send them emails, and you need to store the information that shows evidence of their consent.

Source: I'm not a lawyer.

Answer 2

If there is no audit trail for consent then there is your answer. GDPR is all about improving accountability for things like this.

Answer 3

You question is missing the right point. What is important from a GDPR perspective is personal data. Since an e-mail address may contain personal data such as name.surname@example.com, you should process all e-mail addresses as personal data.