News

23 May 2018

Most GDPR emails unnecessary

The vast majority of emails flooding inboxes across Europe from companies asking for consent to keep recipients on their mailing list are unnecessary and some may be illegal, privacy experts have said, as new rules over data privacy come into force at the end of this week.

Many companies, acting based on poor legal advice, a fear of fines of up to €20m (£17.5m) and a lack of good examples to follow, have taken what they see as the safest option for adhering to the General Data Protection Regulation (GDPR), asking customers to renew their consent for marketing communications and data processing.

But Toni Vitale, the head of regulation, data and information at the law firm Winckworth Sherwood, said many of those requests would be needless paperwork, and in some cases illegal.

“Businesses are not required to automatically ‘repaper’ or refresh all existing 1998 Act consents in preparation for the GDPR,” Mr Vitale said. “The first question to ask is, which of the six legal grounds under the GDPR should you rely on to process personal data? Consent is only one ground. The others are contract, legal obligation, vital interests, public interest and legitimate interests.

“Even if you are relying on consent, that still does not mean you have to ask for consent again. Recital 171 of the GDPR makes clear you can continue to rely on any existing consent that was given in line with the GDPR requirements, and there’s no need to seek fresh consent. Just make sure that your consent met the GDPR standard and that consents are properly documented.”

What’s more, Mr Vitale said, if the business really does lack the necessary consent to communicate with you, it probably lacks the consent to email you for permission in the first place.

Paul Jordan, the Europe managing director of the International Association of Privacy Professionals, offered one silver lining. “I think it’s quite clear that a number of companies won’t be ready for GDPR, but if they can demonstrate they have been planning appropriately then regulators will give them a certain leeway.”

You may also like:

• An overview of GDPR
• Preparing for GDPR – 12 steps to take now 
  

Read more like this here.