Hacker News Reader

Comment by 2Gkashmiri | Hacker News Reader

I don't think by that time it belongs to Anna.

If an email existed on her mailbox, it would be hers. Once it was out of her email, she would not be able to claim ownership of it.

View on HN

It doesn't matter if Anna "owns" the data; The GDPR doesn't care who owns data. What matters is who controls it and what processing they do on it (with storage considered processing).

Does Anna have control over benjamins inbox?

No, but Benjamin does, so if Benjamin's use of Anna's personal data in the inbox is in scope of the GDPR then Anna has rights that she can enforce against Benjamin.

I don't believe that GDPR applies to a mailing list, let alone to private email between individuals. Does someone have chapter and verse?

GDPR article 2(2)c. It will not apply to the receiver of the email, but maybe to the provider. Perhaps it depends on the kind of relationship between the two parties. Mailing lists will be covered.

Side note: I know someone who requested their data to their DPA, and part of the response contained emails mentioning them and their complaints in the _content_ of the message (they were not in the From:, To:, Cc:, or Cci: fields). All names and emails address were censored, though, in accordance with 15(4).

It depends - what's the purpose of the mailing list? If it's for purely personal or household purposes (e.g. a group of friends/family) then it's out of scope by virtue of Article 2(2)(c). Otherwise it'd likely be in scope with the list admin being the data controller.

Reply on news.ycombinator.com