GDPR and two-party communications
<p>If a chat or email provider wishes to analyze the contents of what their customers are writing, does GDPR require it to obtain the consent of everyone involved in the chat/email?</p>

<p>Or would the consent of one party be sufficient for the provider to analyze the chat, and then offer the results of that analysis only to that one user?</p>

<p>First, I believe that you're "close enough to the edge" that you need the advice of a qualified lawyer, not some random guys on a message. (I'm not a lawyer and this is not intended as legal advice.)</p>

<ul>
<li>The GDPR is mostly concerned with personally identifiable data. The content of a chat <em>may or may not</em> qualify for that without any metadata. The metadata probably does qualify without any content.</li>
<li>I guess the goal of the data processing is some profiling of the chat partners. If the company does not know who the chat partners are and cannot deduce it from the data it has, there may be some scope for analysis.</li>
<li>There have recently been interesting court decisions regarding the inheritance of <a href="https://www.bbc.co.uk/news/world-europe-44804599" rel="nofollow noreferrer">social media accounts</a>, which may or may not be applicable to other ways how one can come into possession of data. In this case, the argument went that the heirs could access data just as they could have accessed physical letters in the possession of the deceased. </li>
</ul>

<p>The answer depends on whether the company has a presence in the EU.  If it does, it needs the consent of everyone whose personal data are present in the chat or e-mail.  Since e-mail addresses and chat account identifiers are personal data, that is most likely everyone.</p>

<p>If the company has no presence in the EU, then it needs consent only from those people who are in the EU and whose personal data are present.</p>

gdpr consent