Status: Complaint submitted to the Austrian Data Protection Authority
Date of complaint: 21 August 2026
Relevant GDPR provisions: Articles 12 and 15 GDPR
Main issue: Whether a work email address was collected from an external source, supplied by a third party, or generated, inferred, predicted or verified algorithmically
- Background
On 27 July 2026, I received a transparency notice from a business-contact data provider informing me that it processed personal data concerning me.
I had not provided these data to the company myself.
I therefore exercised my right of access under Article 15 GDPR, with particular emphasis on the origin of the personal data held about me. My request specifically concerned my work email address and telephone number.
The purpose of my request was straightforward:
I wanted to understand where these particular pieces of personal data had come from.
- My initial Article 15 request
In my request, I asked the company to identify the original source from which my work email address and telephone number had been obtained.
For each data element, I requested, where available:
- the exact source rather than merely a general category;
- whether the information had been obtained directly or indirectly;
- the identity of the organisation or person from whom it had been obtained;
- the date or approximate date on which it had first been collected;
- and whether it originated from another data broker, customer, partner, public website, conference attendee list, social-networking platform or another identifiable source.
I also anticipated the possibility that the precise source might no longer be identifiable.
In that situation, I asked the company to explain whether the original source had ever been recorded, whether that information had subsequently been deleted, or whether the inability to identify a source resulted from combining information from multiple datasets.
This was particularly important to me because my telephone number is private and my work email address is not intentionally published by me for general business-contact purposes.
- The company’s response
On 17 August 2026, the company responded to my Article 15 request.
It provided a list of personal data concerning me and explained generally that it processes business-contact information including names, companies, telephone numbers, email addresses, office addresses, job titles and education.
The response also stated that personal data may be shared with customers and with certain categories of service providers, including contact-information verification and marketing service providers.
However, the answer concerning the origin of my data was much less specific.
Rather than identifying the source of my particular work email address, the company referred to its privacy policy and listed broad categories of possible sources, including:
- professional networking platforms;
- customer relationship management platforms;
- social media platforms;
- emails, email accounts or contacts;
- and other sources.
It additionally stated that it collects business-contact records with the consent of international customers.
Had the answer stopped there, the issue would primarily have concerned whether those general categories constituted sufficient information concerning the source.
But the response contained another statement that made the question substantially more interesting.
- The algorithmic-determination issue
The company also stated that it uses proprietary methods to:
“algorithmically determine accurate business contact information.”
This introduced a second possible explanation for the existence of my work email address in its records.
Perhaps the address had been collected from somewhere.
But perhaps it had instead been derived or determined algorithmically.
Those are materially different provenance paths.
Conceptually, the possibilities appeared to include:
External source → Company → my email address stored
or:
Other information about me/my employer → algorithmic determination → my email address
There was also a possible combination:
Algorithmically generated/predicted address → verification process → stored email address
The company’s response did not tell me which of these paths applied to my particular email address.
- “Lineage data”
The company also explained that it does not collect what it called “lineage data” and stated that it had provided all available information regarding the source of my personal data.
That answer created an important distinction.
I was not asking the company to reconstruct historical information that it had never recorded or no longer possessed.
Instead, I wanted to know whether the information it did possess allowed it to determine something much more basic:
Was my email address collected, supplied, or algorithmically determined?
The absence of detailed “lineage data” does not, by itself, answer that different factual question.
- My first request for clarification
I therefore wrote again on 18 August 2026.
I asked the company to clarify specifically whether my work email address in its records:
- had been obtained verbatim from an external source;
- had been supplied by a customer, partner or other third party;
- had been obtained from a publicly accessible source; or
- had been inferred, generated, predicted or otherwise algorithmically determined by the company.
If the address had been algorithmically determined, I also requested access, insofar as such information constituted personal data concerning me and actually existed, to the underlying personal data used in the derivation or verification and to information concerning the result of that process.
This was deliberately a narrow request.
I was not asking for proprietary source code, algorithms, trade secrets or information concerning other individuals.
I was asking about personal data concerning me.
- The response remained general
The company responded again on 18 August 2026.
It repeated that all available information concerning the source had already been provided.
It again referred to general categories of sources, its proprietary methods for algorithmically determining business-contact information, and the fact that it does not collect “lineage data.”
Importantly, the company also expressly confirmed that the list it had supplied constituted the complete copy of all personal data concerning me.
Yet the fundamental question remained unanswered:
Which of the company’s own described acquisition or determination methods applied to my email address?
- A final clarification
To avoid any misunderstanding, I wrote once more.
I expressly clarified that I was not asking the company to reconstruct information it did not possess.
Instead, I asked it simply to establish whether my work email address had been:
collected from a source
or
derived by the company itself.
If it had been generated, inferred, predicted or verified algorithmically, I requested the personal data retained in connection with that process, including any verification status, confidence indicator, source indicator, timestamps or similar information, insofar as such personal data existed.
This limitation was intentional: my request concerned existing personal data, not the creation of new records for the purpose of answering me.
- The final answer
On 20 August 2026, the company replied:
“Unfortunately, we have provided you with all the available information regarding the source of the personal data.”
No further explanation was provided.
As a result, even after several exchanges, I still could not determine whether my work email address had been:
collected from an external source, supplied by a customer or third party, obtained from a publicly accessible source, algorithmically generated or inferred, or subsequently verified by the company.
- Why this distinction matters
This case raises a slightly different question from the conventional data-provenance problem.
A traditional Article 15(1)(g) question might be:
From which source did you obtain my personal data?
But modern data-enrichment systems introduce another possibility:
What if the specific personal data were not obtained as an existing value from a source at all?
For example, a system might possess a person’s:
name + employer + company domain
and use those data to predict:
firstname.lastname@company.com
Whether that happened in my case is not established.
That is precisely the unresolved question.
But where a controller itself states that it uses proprietary methods to algorithmically determine business-contact information, it becomes important to distinguish between information that was collected and information that was derived.
- The provenance paradox
The difficulty can be expressed quite simply.
The company identified multiple ways in which business-contact information may enter its systems:
External platforms / customers / contacts / other sources → collection
and
Existing information → proprietary algorithmic determination → business-contact information
Yet when I asked which route applied to my particular email address, I was told only that all available information had already been provided.
This produces what I regard as the central transparency problem in this case:
If a controller cannot determine whether a personal-data element was collected from somewhere or created through its own derivation process, how can the data subject understand the origin of that personal data?
That question is now part of the complaint before the Austrian Data Protection Authority.
- The completeness question
There is a second issue.
The company expressly stated that the supplied list represented the complete copy of all personal data concerning me.
That raises a related question if my email address was in fact algorithmically determined or verified.
Would records such as a verification result, confidence assessment, inferred value, status indicator or associated timestamp constitute personal data concerning me if such records existed?
My request did not assume that these records necessarily exist.
Instead, I expressly conditioned the request upon their existence.
The issue is therefore not whether a controller must create such information retrospectively.
It is whether any already-existing personal data associated with the determination or verification of my contact information should have formed part of the access response.
- Complaint to the Austrian Data Protection Authority
On 21 August 2026, I submitted a complaint to the Austrian Data Protection Authority concerning the right of access. The complaint was registered under incoming number 2026-2108151657653.
I explained the chronology of the request and the subsequent attempts to obtain clarification.
The complaint asks the authority to examine whether the information supplied by the company—particularly concerning the origin of my personal data and the completeness of the personal data provided to me—complies with Articles 12 and 15 GDPR.
I formally requested a finding that my right of access had been infringed.
- What this case does not establish
It is important to distinguish documented facts from unresolved possibilities.
The documents do not establish that my work email address was algorithmically generated.
They also do not establish that it was obtained from a particular external website, social network, customer, database or other source.
Nor do they establish that additional verification or confidence data necessarily exist.
Those possibilities remain unresolved.
- What is documented is that:
- the company processed personal data concerning me;
- I requested information concerning their origin;
- the company identified broad categories of possible sources;
- the company stated that it also uses proprietary methods to algorithmically determine accurate business-contact information;
- the company stated that it does not collect “lineage data”;
- it stated that the data supplied to me constituted the complete copy of my personal data;
despite repeated clarification requests, it did not identify which of its described acquisition or determination methods applied to my specific work email address; and
I consequently submitted a complaint to the Austrian Data Protection Authority.
15. Why I am documenting this case
This case illustrates how the meaning of “source” becomes more complicated in data-enrichment systems.
Personal data do not necessarily enter a database solely because somebody copied them from another database.
They may potentially be:
collected, combined, inferred, predicted, generated, enriched or verified.
The GDPR right of access becomes especially important in such environments because the data subject may otherwise see only the final result.
In my case, the final result is simple: a work email address associated with me existed in a commercial business-contact database.
The unresolved question is how it got there.
Was it found?
Was it supplied?
Was it derived?
Was it predicted and subsequently verified?
Or does the company genuinely hold no information from which it can determine which process occurred?
Those distinctions are not merely technical.
They determine whether a person can meaningfully understand the provenance of personal data concerning them.
- Current status
The complaint was submitted to the Austrian Data Protection Authority on 21 August 2026.
The authority has been asked to determine whether the access response—particularly regarding the provenance of my work email address and the completeness of the personal data supplied—satisfies the requirements of Articles 12 and 15 GDPR.
Until that question is resolved, I regard the following as the central open question in Case 7:
When a company both collects business-contact information from external sources and uses algorithms to determine such information, what must it tell a data subject about how one specific piece of personal data concerning that person was actually obtained or created?
Note
This case report describes my own experience and the contents of correspondence and documents submitted in connection with my GDPR request and complaint to the Austrian Data Protection Authority.
It does not establish that the company unlawfully generated, inferred, collected or disclosed my email address, nor does it assert that particular algorithmic or verification records exist.
Where the precise source, derivation method or existence of associated records remains unknown, those matters are presented here as questions for clarification and regulatory assessment, not as established facts.