The actions of the CNIL aim to regulate the processing of personal data. “Data processing” means any operation or group of operations relating to personal data. This therefore concerns the entire process of data: collection, recording, organization, conservation, modification, extraction, consultation, use, etc.).

Consequently, maintaining a prospecting file, a customer database or even the collection of data via web forms must meet the requirements of the CNIL.

Firstly, any data processing must correspond to a clear and specific objective. This purpose must obviously be legal but also legitimate with regard to your professional activity.

Next, if you collect data, you need to be able to inform your contacts about how you use their personal information. You must also guarantee use of data that respects their privacy.

Thus, virtuous data processing must meet several requirements:

• Relevance: are the data collected really necessary for the intended objective?
• Transparency: have the people whose data we process received clear and explicit prior information?
• Respect for rights: can we guarantee the rights to information, access and erasure of data?
• Data control: are the sharing and circulation of data supervised and contractualized?
• Security: are IT security measures sufficient to guarantee data protection?

In practice, the GDPR now requires companies to have a register of the processing implemented. But, above all, the legislation raises questions on 2 crucial points: the notion of consent and the right to opposition.

The rules regarding B2B prospecting

For B2B professionals, the GDPR has not disrupted existing legal rules. The principle is always that of prior information and the right of opposition. When collecting their email address, you must inform the person that their email address will be used for prospecting actions. You must also ensure that they can object to this use in a simple and free manner.

In practice, the explicit consent of the prospect (opt-in) is strongly recommended by the CNIL but it is not obligatory in B2B (unlike B2C). It is therefore authorized to continue to do opt-out emailing provided that:

• Inform about the conditions of data processing
• Respect the right to object
• Ensure that the subject of the solicitation is related to the profession practiced by the prospect

In any case, in each email, you must include:

• The identity of the sender
• An easy way to opt out of receiving future messages (e.g. in the form of an unsubscribe link at the end of the message)

What impact in the context of a database purchase or rental?

When you use a purchased or rented prospecting file, you carry out data processing operations. However, you do not intervene in the data collection phase.  

Despite everything, by contacting prospects by email on your behalf, you are required to respect the regulations in force and, ideally, to respect the ethical recommendations issued by the CNIL.

When you first communicate to the contacts on the list, you must tell them how to exercise their rights, in particular the right to object, as well as the source from which the data used comes. 

Then, each of your messages should include:

• Mention of your company
• The reason the contact is receiving communication from you
• An object related to the profession of the person contacted
• An unsubscribe link

You must also regularly update your file by taking into account unsubscribe requests from contacts.

Choose a service provider that respects legislation and ethics

Contact consent is only recommended by the CNIL in B2B . But, when you are looking for a service provider for purchasing or renting a file, you will benefit from finding out about the data collection methods.

Certainly, you can contact prospects from non-opt-in lists. But be careful of the consequences.  

Most messaging services have powerful algorithms that allow them to detect non-opt-in databases or lists that are already largely overused. By going through an unscrupulous service provider, you risk finding yourself blacklisted. Your emails will land directly in spam messages and your deliverability will be permanently affected.

If your messages still arrive in your recipients' inboxes, you also run the risk of them being flagged as spam. 

You should therefore check with the service provider about the origin of the data. In addition, it is also in your interest to work on a finely segmented list. Indeed, the CNIL requests that requests be directly related to the position of the person contacted.

Good segmentation will make your contact more natural. Finally, obviously, the relevance and quality of the message will have an impact on the reaction and engagement of contacts.