WTF? How did they get my address?

In the world of emailing, complaints and non-compliance are numerous. At Badsender, the experts who investigate these cases are members of an elite unit called the Dezzers. Here are their stories! DUNDUUUUUN!!!! Sorry... I digress.

The names of the companies incriminated here are all anonymized, because I believe that everyone has the right (the duty!) to clean up their practices and not to suffer from their past mistakes ad vitam.

This is my story...

I recently had the opportunity to track down an email sent on my personal mailbox from an unknown company. Messaging that is strictly reserved for exchanges with my relatives, which although quite simple to guess is only communicated in certain specific cases.

Here, in front of your amazed eyes, is a copy of the famous email.

So we can quickly deduce that this email was sent to me without my consent. This kind of case particularly tickles me and as my colleagues like to say, I do not represent the majority of Internet users and their actions in front of this type of unwanted communication. By this I mean that when I receive a campaign for which I have never, in my memory, given my consent... I do not click on the unsubscribe link. No, ladies and gentlemen! I roll up the sleeves of my raincoat, put on my monocle and try to follow the small pebbles scattered here and there.

Taïaut to the attack!

To be honest, I did not expect to receive an answer to my request, in which I expressed my desire to receive a copy of the personal data in their possession concerning me, as well as their origins and of course the proof of my consent (maybe I sleepwalk and subscribe to mailing lists while I'm asleep... who knows). I also took the liberty of reminding you of the risks a company faces in the event of a breach of the GDPR, just in case.

To my great surprise, not even 2 hours passed between my torpedo my email and the answer of the co-founder of the said company. Very transparent, he tells me the source of the list shot: an agency specialized in data, which I quote "scans the web to send you qualified leads and automates all the time-consuming tasks related to prospecting. Bad move for them, I am not one of those who can be easily qualified (professional deformation I guess... or just boring ^^).

After this first step, which I must admit was quite easy, I was all revived! Continuing on my way, I snooped around on the website of this agency that boasts of identifying and sourcing the best prospects. I might as well tell you that they didn't just make a friend. Let's move on!
I transfer my request to them. After a few days, I receive an answer from their Customer Success Manager, with this time the complete list of my information in their database. It includes the region where I live, my position, obviously my first and last name, information about Badsender, a link to my Linkedin page (tilt!)... and the source: another agency.

At this stage, I felt like a simple email address sold to the highest bidder. Taking my time, I forwarded my email again (yes, it takes dedication)in which I obviously asked to be unsubscribed each time.
This time it took me a reminder before I got an answer from this 3^ème agency. My approach must have been taken a little more seriously: the CEO responded in less than 10 minutes. Finally, did I get to the 1^era agency, owner and reseller of the list of "qualified" prospects? It is with a little bit of I was stunned to learn where my data came from. Not so naive, I had understood that the leak came from my Linkedin account... nevertheless, my personal address is not indicated there!

And the method explained by the agency to collect the emails...

"Your email was found through the Rapportive extension of Sales Navigator assuming the email with your first and last name."

Rather vague for my taste, I ask for more information on the provenance.

"The source of your data comes from LinkedIn Sales Navigator from a search, this data is public and added by you when you register, as well as your personal email which is automatically available when someone gets in touch with you.
We didn't get your email in the direct form (i.e. a basic purchase or something like that), we generated your email (...) assuming firstname.lastname@(gmail.com,outlook.com,yahoo.fr...) and then offered this email to our client who decided to use it.

In the future if you don't want to have this kind of problem with other services, I would advise you not to enter your email on LinkedIn, because every person who comes in contact with you will be able to use it and find it."

Thank you for this advice!

After reading Linkedin's terms and conditions, it is indeed mentioned that we give our consent to the use of our data by the social network services and their partners:

"When members join LinkedIn, they expressly agree to our Terms of Service, including receiving promotional and other messages from us and our partners."

I don't blame the social network. I joined of my own free will to develop my professional network and allow anyone to contact me in this context. There was a time, when I was a freelancer, my account indicated a personal address (but not the one shot...) and since 2015 the email address on my account is that of Badsender, also available on the agency's website >> which is therefore not a secret.

OK! But then, apart from receiving an email without my consent, why isn't the address used my primary address on the network?
Does "assuming" someone's personal email address, under the pretext of being part of their network (and this is not the case here, I am not in relation with any of these agencies) comply with the RGPD? Is it allowed to generate email addresses (professional and personal) from data collected on a social network? Can we freely exploit this data? Plus, is it legal to monetize this information?

Although I have an idea of the answers, I will try to clarify these points with the CNIL and a lawyer soon. Stay tuned !