These questions landed in my inbox last month from three different compliance teams, all within 48 hours. A sales ops director wanted to know if her team could reconstruct email addresses from public LinkedIn profiles. A marketing counsel asked whether purchasing "enriched" contact lists violated GDPR. A DPO forwarded a vendor contract that promised "GDPR-compliant email reconstruction services."
The common thread: organizations assume that if someone's name and company are publicly visible online, reconstructing their professional email address ([email protected]) is fair game. It's not that simple.
The CNIL recently clarified that email address reconstruction must comply with GDPR to be legal, and that framework creates obligations most teams haven't considered. Here's what you're actually asking when these questions come up.
Does GDPR Apply if the Email Format is Obvious?
Yes, and here's why that catches people off guard.
Your team sees "Jane Smith works at Acme Corp" on a public profile and reconstructs [email protected]. That reconstruction is processing personal data under Article 4(2) GDPR. The fact that the underlying information (name, employer) was publicly accessible doesn't exempt you from the regulation.
You've created a new data point by combining publicly available elements into a direct contact method. That combination constitutes processing, and processing requires a legal basis under Article 6. "It was easy to figure out" isn't a legal basis. Neither is "the information was already public."
The relevant question isn't whether you can reconstruct the address. It's whether you have lawful grounds to process it for your intended purpose, which is almost always direct marketing.
What's the Legal Basis for Using Reconstructed Emails?
This is where most programs fall apart.
Legitimate interest (Article 6(1)(f)) is the basis teams typically claim, arguing that B2B prospecting serves their commercial interests and doesn't override the individual's rights. That assessment fails under the ePrivacy framework, which requires prior consent for electronic marketing in most EU member states.
Even if you're operating under a regime that permits legitimate interest for B2B marketing, you must conduct and document a legitimate interests assessment (LIA). That assessment needs to answer: Did the individual reasonably expect you to obtain and use their email this way? Can they easily object? Have you provided transparent information about the processing?
If you reconstructed the email from scattered public data, the individual didn't provide it to you directly, and they likely don't expect to receive your outreach. Your LIA needs to address that expectation gap, and "we sent an unsubscribe link" doesn't cure the initial lack of consent.
Consent under Article 6(1)(a) is the cleaner path, but it requires you to obtain clear affirmative action before you use the reconstructed address. That means you can't send the first email to ask for consent; you need consent before the initial contact. Most reconstruction scenarios can't meet that requirement.
Can We Buy "Enriched" Lists if the Vendor Says They're Compliant?
You're still the controller for how you use that data.
When a vendor sells you a list of reconstructed professional emails, they're claiming they've processed the data lawfully. Your contract should require them to warrant their legal basis and indemnify you for their collection practices. But you remain responsible for having a legal basis to use those emails for your purposes.
Article 5(2) requires you to demonstrate compliance. "The vendor said it was fine" won't satisfy a supervisory authority if someone complains. You need to know:
- What legal basis the vendor relied on for reconstruction
- Whether they provided transparent information to the individuals at the point of data collection (which is impossible if the data was scraped)
- Whether the individuals were offered an objection mechanism before the data was sold
- Whether your intended use aligns with the vendor's original purpose disclosure
If the vendor scraped LinkedIn, reconstructed emails algorithmically, and sold the list without individual notice, you're inheriting a compliance liability. The individuals never consented to receive marketing from you, and they weren't informed their data would be processed this way.
What if We Only Use Reconstructed Emails for "Relationship Building," Not Hard Sales?
The purpose doesn't change the legal framework.
"Relationship building" is still direct marketing under the ePrivacy Regulation. Sending an email to introduce your company, share a whitepaper, or "start a conversation" constitutes electronic marketing communication. The content's soft sell doesn't exempt you from the prior consent requirement.
Some teams try to reframe outreach as "legitimate business communication" rather than marketing. That argument works only if you have a genuine pre-existing business relationship or the communication relates to an ongoing transaction. Cold outreach to a reconstructed email doesn't meet that threshold, even if your message is educational rather than promotional.
What Rights Do Individuals Have if We've Reconstructed Their Emails?
They can object under Article 21, and you must honor that objection.
If someone replies to your outreach asking how you obtained their email, you're required to provide transparent information under Article 14 (since you didn't collect the data directly from them). That disclosure must include your legal basis, the source of the data, and their right to object.
When they object, you must stop processing their email for marketing purposes. You can't require them to click an unsubscribe link or complete a form. The objection itself is sufficient.
They also have the right to request erasure under Article 17 if you don't have an overriding legal basis to retain the data. "We want to keep marketing to them" isn't an overriding basis.
What About Professional Emails at Public Institutions?
The same rules apply, but enforcement context matters.
Professional email addresses are still personal data under GDPR if they identify an individual ([email protected]). The fact that the email is work-related and publicly listed doesn't remove it from GDPR's scope.
Some member states have carved out limited exemptions for professional contact details in B2B contexts, but those exemptions are narrow and don't generally cover automated reconstruction and bulk marketing. You still need a legal basis, and you still must honor objection and erasure rights.
Where Does This Leave Outbound Programs?
If your outbound strategy relies on reconstructed emails, you need to rebuild it around affirmative consent or verifiable legitimate interest.
The defensible approaches:
- Obtain consent through a form, event registration, or content gate before using the email
- Limit outreach to individuals who've shared their professional email directly with you in a business context
- Conduct and document a legitimate interests assessment for each use case, and provide clear objection mechanisms in every communication
- Implement suppression processes that honor objections immediately, without requiring the individual to take further action
The CNIL's guidance makes clear that "everyone does it" isn't a compliance strategy. Reconstruction is processing, processing requires a legal basis, and most reconstruction workflows can't demonstrate one.
If you're buying enriched lists, scraping public profiles, or using pattern-matching tools to generate professional emails, your legal team needs to map the data flow and identify where the legal basis breaks down. The answer usually isn't "stop all outbound." It's "stop outbound to people who never agreed to hear from us."
