Scope
This guide explores the legal and operational framework for reconstructing professional email addresses from publicly available data under GDPR Article 6(1)(f) (legitimate interest). It applies to organizations conducting B2B prospecting, institutional outreach, or creating professional contact databases within the EU.
What's included:
- GDPR requirements for email reconstruction as a processing activity
- Assessment criteria for legitimate interest claims
- Implementation safeguards and operational controls
- Common compliance failures and how to avoid them
What's excluded:
- Consumer (B2C) email reconstruction (different legal basis required)
- Email addresses obtained through data purchases or third-party lists
- Technical methods for pattern-matching or scraping (focus is legal framework, not tooling)
Key Concepts and Definitions
Email reconstruction: Deducing a professional email address by combining publicly available information (first name, last name, employer) with identified organizational email patterns (e.g., [email protected]).
Legitimate Interest (Article 6(1)(f)): A legal basis for processing that permits data use without prior consent when three conditions align:
- The controller has a real, specific interest.
- Processing is necessary to achieve that interest.
- The individual's rights do not override the controller's interest.
Reasonable expectation test: An assessment of whether an individual could anticipate their data would be used in a specific way, based on the context in which they made it available.
Proportionality assessment: The GDPR-mandated balancing test between your organizational interest and the potential harm to individuals' privacy rights.
Requirements Breakdown
Article 6(1)(f) Three-Part Test
Your reconstruction practice must satisfy all three prongs:
| Requirement | What You Must Demonstrate | Documentation Needed |
|---|---|---|
| Legitimate interest exists | Specific business need (e.g., "expand institutional partnerships in fintech sector") | Written business justification tied to strategic objectives |
| Processing is necessary | No less intrusive alternative achieves the same goal | Analysis showing why published contact forms, LinkedIn InMail, or direct requests are insufficient |
| Balance favors controller | Individual's privacy impact is proportionate to your interest | Completed Legitimate Interest Assessment (LIA) |
Contextual Factors: Online Visibility Analysis
You must assess whether the individual's online presence suggests they would reasonably expect email reconstruction. The CNIL guidance identifies two scenarios where reconstruction likely fails the expectation test:
Red flags (do not reconstruct):
- No identifiable professional online presence (no LinkedIn profile, no company bio page, no conference speaker listings)
- Active privacy controls (restricted LinkedIn visibility, no direct email listed despite senior role, contact forms used instead of direct addresses)
These indicators suggest the individual has deliberately limited discoverability. Reconstructing their address contradicts their demonstrated preferences.
Neutral-to-green signals:
- Public LinkedIn profile with employer listed
- Name appears on company "Team" or "About" pages
- Professional conference participation or publication authorship
Even with green signals, you still need safeguards (see Implementation Guidance).
Purpose Alignment Requirement
Email reconstruction is rarely standalone processing. It's a technical step toward a broader objective (prospecting, institutional outreach, partnership development).
Critical rule: The reconstruction must share the same legal basis for processing as the primary purpose. If your prospecting campaign relies on legitimate interest, the reconstruction can too. If your primary purpose requires consent, so does the reconstruction step.
This alignment isn't automatic. You must document why the reconstruction method matches the intrusiveness level of your end goal.
Implementation Guidance
Step 1: Document Your Legitimate Interest
Draft a written LIA before you begin reconstruction. Include:
- Specific interest: "Build qualified prospect database for enterprise SaaS sales in healthcare vertical"
- Necessity analysis: "Target organizations don't publish department-level contacts; general inquiry forms route to sales, not technical decision-makers"
- Balancing test: "Individuals are senior IT roles at mid-market companies; professional contact is expected; we implement time-limited retention and one-touch opposition"
Step 2: Apply Visibility Filters
Before reconstructing an address, verify:
- Does the individual have a public professional profile (LinkedIn, company bio, industry directory)?
- Have they listed an employer openly?
- Are there signs they've restricted visibility (privacy settings, absence from expected channels)?
If you answer "no" to questions 1-2 or "yes" to question 3, exclude that individual from reconstruction.
Step 3: Implement Operational Safeguards
The CNIL guidance recommends two specific controls to limit impact:
Time-limited retention: Retain reconstructed addresses only if you establish actual contact within a defined period (e.g., 30 days). If no response or engagement occurs, delete the address. Don't stockpile unverified contacts.
Absolute opposition right: If an individual objects to email reconstruction (not just prospecting), honor that objection immediately without requiring them to demonstrate a "situation particulière" (particular situation). This goes beyond the Article 21(1) right to object, which normally permits you to invoke "compelling legitimate grounds" to continue processing. For reconstructed addresses, you waive that defense.
Step 4: Disclosure and Transparency
When you send the first email to a reconstructed address, your message must include:
- Clear identification of your organization
- Explanation that you reconstructed their address from public data
- Purpose disclosure (why you're contacting them)
- Right to object and how to exercise it (simple, one-click method)
- Link to your privacy notice covering reconstruction practices
This isn't just Article 13 compliance. It's your evidence that the individual could reasonably expect contact, because you're making the practice explicit immediately.
Common Pitfalls
Pitfall 1: Treating Public Data as Consent-Free
The mistake: "We found their name on LinkedIn, so they obviously want to be contacted."
Why it fails: Public availability doesn't equal consent or reasonable expectation of use for your specific purpose. You still need a valid legal basis for processing and must complete the balancing test.
Fix: Conduct the LIA even when source data is public. Document why your use aligns with the context in which they published information.
Pitfall 2: Ignoring Privacy Signals
The mistake: Reconstructing addresses for individuals with no online presence or restricted profiles, assuming "they're professionals, they should expect it."
Why it fails: Absence of visibility is itself a signal. The CNIL guidance explicitly identifies lack of online presence as an indicator that reconstruction is inappropriate.
Fix: Build visibility checks into your workflow. If someone has taken steps to limit discoverability, respect that choice.
Pitfall 3: Permanent Database Retention
The mistake: Adding reconstructed addresses to your CRM indefinitely, treating them like any other contact.
Why it fails: Reconstructed addresses carry higher privacy risk than voluntarily provided contacts. Indefinite retention without engagement amplifies that risk and weakens your legitimate interest claim.
Fix: Implement automated deletion for reconstructed addresses that don't result in actual contact within your defined window (30-60 days). Only promote addresses to permanent storage after meaningful engagement.
Pitfall 4: Requiring Justification for Opposition
The mistake: When someone objects to reconstructed emails, asking them to explain why or invoking "compelling legitimate grounds" to continue.
Why it fails: The CNIL recommends treating opposition to reconstruction as absolute, not subject to the Article 21(3) balancing test.
Fix: Configure your suppression process to honor reconstruction objections immediately, without requiring the individual to demonstrate their particular situation.
Pitfall 5: Conflating B2B with Lower Standards
The mistake: "It's B2B prospecting, so GDPR is more relaxed."
Why it fails: Professional email addresses are still personal data when they identify an individual ([email protected]). The ePrivacy Regulation's B2B carve-out applies to direct marketing rules, not GDPR's lawfulness requirements.
Fix: Apply the same rigor to professional address reconstruction as you would to any personal data processing. Don't assume B2B context automatically satisfies the balancing test.
Quick Reference Table
| Question | Assessment | Action |
|---|---|---|
| Does the individual have a public professional profile? | No | Do not reconstruct, fails expectation test |
| Has the individual restricted profile visibility or used privacy controls? | Yes | Do not reconstruct, signals intent to limit discoverability |
| Can you document a specific, legitimate business interest? | No | Do not proceed, fails Article 6(1)(f) first prong |
| Is reconstruction necessary, or could you use a less intrusive method? | Less intrusive option exists | Use alternative, fails necessity test |
| Will you retain addresses indefinitely without engagement? | Yes | Revise retention policy, implement time-limited storage |
| Will you require individuals to justify opposition? | Yes | Remove justification requirement, opposition should be absolute |
| Does your first email disclose the reconstruction practice? | No | Add disclosure, transparency is required under Article 13 |
| Have you completed a written LIA? | No | Document before processing, required to demonstrate compliance |
Remember, email reconstruction isn't prohibited under GDPR, but it's not automatically lawful either. Your legitimate interest claim succeeds or fails based on context, necessity, and the safeguards you implement. When in doubt, ask yourself whether the individual would be surprised to receive your email. If the answer is yes, your balancing test probably fails.
