Using phonebooks or public data for commercial purposes, GDPR

Question

I'm wondering if it is legal for individuals or companies to use phonebook data for commercial purposes, such as contacting people found on the phone book to sell them products or services, or even selling that data to companies as leads so that they can contact them to try and sell their products/services.

From a GDPR perspective, I lean to conclude that people would have had to give their consent for their phone number to be used by companies to contact them, right? But it seems hard to find what did people sign and consented to by accepting on being listed on phonebooks.

Answer 1

What’s the legal basis for processing the data?

Basically all GDPR issues need to start with this. Why are you doing this? Is that a legitimate use?

Whatever decisions on that the phone book company made are not relevant to your decisions on that.

There will be some use cases that are legitimate and some that aren’t. Cold marketing calls are likely on the illegitimate side.

Answer 2

In many countries affected by the GDPR, there are national laws against cold calling (e.g. germany, §7 UWG with fines as high as €300,000).

But since you asked about the GDPR, the consent by the people listed in the phone book would cover only the phone book publisher and data processors listed in the terms, and only the purposes listed in the terms. You are not on that list, presumably, and neither is cold calling.

Answer 3

united-states

In the U.S., the GDPR does not apply, and in the context of the domestic telephone call, it is hard to see how it could even unintentionally. There is a specific laws regarding junk faxes and there is a Fair Trade Commission robocall regulation (and in some U.S. jurisdictions, attorney cold calls are prohibited as a matter of attorney professional ethics).

As an aside, the junk fax law is pretty much the only federal law which can only be enforced in state court and cannot be enforced in federal court.