Email prospecting and GDPR: what is allowed in B2B in Luxembourg

A Luxembourg salesperson who sends a cold email to a prospect identified by first and last name risks non-compliance, even in a strictly professional context. This article is for executives, marketing managers and sales staff who build or buy contact databases for B2B prospecting.

The principle: opt-in remains the rule, even in B2B

Many companies assume that a business contact allows anything, since it is a business relationship and not a private individual. The CNPD points out that, without prior consent, natural persons have the right not to receive unsolicited commercial emails, which makes opt-in the default regime for all email prospecting, in a news item published on 25 May 2018. This framework comes from the amended law of 30 May 2005 on the protection of privacy in the electronic communications sector (loi modifiée du 30 mai 2005), which transposes Directive 2002/58/EC and its revision by Directive 2009/136/EC.

In practice, this means that a prospecting email sent without the recipient's prior agreement is non-compliant by default, whatever the professional status of the person contacted.

The soft opt-in exception: what it really allows

There is a tolerance known as soft opt-in. A company that obtained a customer's contact details in the course of a sale or a service may send that customer offers for similar products or services without collecting new consent, according to the CNPD. Two cumulative conditions apply, however: the customer must have been informed of this use when their data was collected, and every message sent must give them a simple, free way to object to these solicitations.

This exception therefore covers only existing customers, for products or services comparable to those already purchased. It does not apply to a prospect who has never had a contractual relationship with the company, even if their address was found publicly on a business website or a network such as LinkedIn (see our article on LinkedIn in Luxembourg).

Named or generic addresses: a difference that changes everything

The CNPD texts do not explicitly distinguish B2B from B2C: the protection covers natural persons, with no exclusion for the professional context. An address in the format [email protected] identifies a specific employee and is personal data subject to this opt-in regime, just like a private address. Conversely, a generic address such as info@ or contact@ does not point to any identifiable natural person and is not personal data within the meaning of the GDPR, which leaves more room for prospecting without formal prior consent. However, the CNPD sources consulted do not settle this area as clearly as the regime for named addresses, so caution is advisable in case of doubt.

Checklist for auditing your prospecting database

Before launching a campaign, it is worth running each contact in the database through the following filter:

• Is the address named (identifies a natural person) or generic (info@, contact@)?
• For a named address, is there proof of prior consent (form, ticked box, previous exchange)?
• Without consent, is there a documented customer relationship (sale, contract, past service) justifying soft opt-in?
• If soft opt-in applies, was the person informed of this use when their contact details were first collected?
• Does each email in the campaign contain a link or notice allowing the recipient to object easily and free of charge to future mailings?

A prospecting database that cannot answer yes to these five points for a given named contact exposes the company to a risk of non-compliance for that specific contact, regardless of the size of the database or the history of the campaign.

What this article does not replace

This overview describes the general framework that applies to email prospecting in Luxembourg, as set out by the CNPD in its thematic file on e-privacy and its 2018 news item. It is not legal advice and cannot settle a disputed case, a borderline situation or a complex database arrangement, for which you should consult a specialist lawyer or contact the CNPD directly. Companies that regularly process personal data for marketing purposes can also check internally whether a data protection officer must be appointed to oversee these practices.