The Commission Nationale de l'Informatique et des Libertés (CNIL) specifies the conditions under which the reconstruction of professional email addresses from information accessible online is authorized by the GDPR.

This practice can be based on legitimate interest, provided that the data controller has a genuine interest and that it does not disproportionately infringe on the rights and interests of the data subjects. To assess this balance, the CNIL recommends considering several criteria. The overall purpose, such as commercial prospecting between professionals, may justify the reconstruction on the same legal basis as the main processing. It is also necessary to analyze the reasonable expectations of the individuals, which depend on their online visibility and the measures they have taken to restrict access to their data. A person without an identifiable online presence or who actively protects their information cannot reasonably expect such reconstruction. The implementation of safeguards is also advised, such as limiting the retention of reconstructed addresses and ensuring an immediate right to object to any future reconstruction. For public bodies, the public interest mission provided for in Article 6, paragraph 1, point e of the GDPR may serve as a basis, applying similar safeguards. If these conditions are not met, the consent of the individual is required.