The CNIL's actions aim to control the processing of personal data. Data processing” means any operation or group of operations involving personal data. This concerns the entire data journey: collection, recording, organization, conservation, modification, extraction, consultation, use, etc.)

Therefore, the maintenance of a prospecting file, a customer database or the collection of data via forms on the web must meet the requirements of the CNIL.

First, any data processing must have a clear and specific purpose. This purpose must obviously be legal but also legitimate with regard to your professional activity.

Secondly, if you are collecting data, you need to be able to inform your contacts about how you are using their personal information. You must also ensure that the data is used in a way that respects their privacy.

Thus, virtuous data processing will need to meet several requirements:

• Relevance: is the data collected really necessary for the purpose?
• Transparency: have the people whose data is being processed been clearly and explicitly informed in advance?
• Respect for rights: can the rights to information, access and deletion of data be guaranteed?
• Data control: are the sharing and circulation of data regulated and contractualized?
• Security: are the IT security measures sufficient to ensure data protection?

In practice, the GDPR now requires companies to have a register of the processing operations carried out. But, above all, the legislation raises questions on two crucial points: the notion of consent and the right to object.

The rules for B2B prospecting

For B2B professionals, the GDPR has not disrupted existing legal rules. The principle is always that of prior information and the right to object. At the time of collection of the email address, you must inform the person that their email address will be used for marketing purposes. You must also ensure that she can object to this use in a simple and free way.

In practice, the explicit consent of the prospect (opt-in) is strongly recommended by the CNIL but it is not mandatory in B2B (unlike B2C). It is therefore allowed to continue to do opt-out emailing provided that:

• Inform about the conditions of data processing
• Respect the right to object
• Ensure that the purpose of the solicitation is related to the prospect's profession

In all cases, in each email, you must include:

• The identity of the issuer
• A simple way to opt-out of receiving future messages (eg, in the form of an unsubscribe link at the end of the message)

What is the impact of buying or renting a database?

When you use a purchased or rented prospecting file, you are performing data processing operations. However, you are not involved in the data collection phase.

Nevertheless, when contacting prospects by email on your behalf, you are required to respect the regulations in force and, ideally, to respect the ethical recommendations issued by the CNIL.

When you first communicate to the contacts on the list, you must tell them how they can exercise their rights, including the right to object, and the source of the data used.

Then, each of your messages should include:

• The mention of your company
• The reason why the contact is receiving a communication from you
• An object related to the profession of the person contacted
• An unsubscribe link

You must also regularly update your file by taking into account the unsubscribe requests of the contacts.

Choose a provider that respects the law and ethics

The consent of the contacts is only recommended by the CNIL in B2B. However, when you are looking for a service provider to purchase or rent a file, you will benefit from finding out how the data is collected.

Of course, you can contact prospects from non-opt-in lists. But beware of the consequences.

Most email services have powerful algorithms that allow them to detect non-opt-in bases or lists that are already heavily overused. If you go through an unscrupulous provider, you risk being blacklisted. Your emails will land directly in the spam folder and your deliverability will be permanently affected.

If your messages still arrive in your recipients' inboxes, there is also a risk that they will report them as spam.

It is therefore advisable to check with the service provider as to the origin of the data. In addition, you should also work on a finely segmented list. Indeed, the CNIL requires that solicitations be directly related to the position of the person contacted.

A good segmentation will make your contact more natural. Finally, of course, the relevance and quality of the message will have an impact on the reaction and engagement of contacts.