List Owners Under GDPR Rules in Europe

[JeffLewis]

I am a US-based marketer who manages lists (in Constant Contact) for a client located in Europe. All additions to the list come from the client, and they are either names and email addresses or just emails (or other contact information) and all have expressly asked to receive communications via email from the client (messages they create and I distribute).  

The client wants to be sure the company is compliant with the General Data Protection Regulation (GDPR).  As such, the client is not sure they can receive the actual file as a spreadsheet periodically (to give them the chance to review the databases and see who is on the lists) as they are not the ones holding the database (Constant Contact, in their view, is). I am of the view that the list belongs to the client; that I (and Constant Contact) are third parties who just hold and manage the list; the client is the owner.  

Looking for opinions. Thank you!

[William_A · Accepted solution]

Hello @JeffLewis ,

Your view is correct, we do not own any lists our customers upload. Our system merely hosts them for ease of management and sending. Thus all GDPR expectations fall to the purview of the list's owners to ensure they're compliant. 

You may wish to provide this article to your clients if they have any further questions on how we operate within GDPR guidelines, and what expectations fall on our users.

[JeffLewis]

Thank you very much!

Jeff