Yes GDPR Also Affects Marketing
Does your Marketing Process Comply with GDPR?
Email contact lists are the bread and butter of the many companies who compile them and make them available for sale. The lists are bought by businesses that want to market to a particular level of employee, a certain senior management position across multiple businesses or even consumers who match a specific geographic and demographic profile. At every marketing webinar, seminar and online coaching class we are told to build a list, so how does GDPR affect this strategy?
Sometimes huge databases are bought, broken down into multiple categories and sold on to small businesses with very specific needs.
Any marketing mail or email must include a declaration, detailing the method the recipient can use to exercise their right to give you notice to stop processing their data for marketing purposes. This cannot be buried in the text of the marketing message but must be a clearly separate statement.
You must comply with the instruction immediately on receipt or you’ll be in breach of the law. In these circumstances you are able to retain the data subject’s information for a single purpose – so that you no longer include them as a recipient for marketing material.
However, the law is flawed because the legislators don’t always understand how data is used. You have no responsibility to pass on the ‘desist from processing’ instruction from the end recipient to whoever sold you the list. Even if you did that, the seller has no obligation to comply with your request for the data to be altered, because you’re not the data subject.
The next time you buy a list it becomes your responsibility to clean it so that you don’t send out marketing to someone who has asked you to stop. You may think that this is going to be a simple job, because you’ll already have on record those who have previously requested that you cease to process their data for marketing purposes (your ‘suppression list’).
Catch 22.5 – The Right to be Forgotten
However, what if the data subject took things a step further? GDPR supports the principle of the ‘right of erasure’ (also sometimes referred to as the ‘right to be forgotten’) under which individuals have a right to have personal data erased and to prevent processing in specific circumstances:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
- When the individual withdraws consent
- When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing
In theory, this seems to imply that when an individual (a data subject) has invoked this right you’ll no longer have a record of who they are, so you’ll be unable to delete them from the list. Because of the way the legislation is constructed, you won’t even be able to retain a paper list of those who have asked for their data to be deleted, since this would be regarded as ‘part of a data system’.
This principle indicates that an entire sector in the marketing chain could be taken out in a single stroke. However, under GDPR (Recital 65) you will be able to retain a copy of the “erased” data for certain limited purposes (including “for compliance with a legal obligation” so, in effect, you will be able to maintain your own ‘suppression list’. This continues to result not in the actual erasure of personal data but rather in suppression.
Under GDPR you will also have a duty to tell anyone to whom you have disclosed the data about the subsequent erasure, unless it is “impossible or involves disproportionate effort to do so” but that duty does not extend to telling anyone who provided you with the data in the first place.
The originators of the data, therefore, will be in the position of retaining and supplying (processing) personal data of a data subject who has already put in effect their right of erasure. As it stands this will not be contrary to GDPR because they will not have received the request exercising that right; as data compilers sell to many customer businesses, the same data will be re-circulated over and over to different businesses, bypassing existing suppression lists which are the responsibility of an individual organisation to maintain for its own use.
If you are struggling with marketing and GDPR, want some clarity and advice phone us for a FREE No Obligation Call on 01244 300413 or email email@example.com
About The LH Group
Call us on 01244 300413
We help businesses stay safe – our risk management consultancy offers clear answers and problem solving for your risk questions.
Get a Quote
What People Say
have been most impressed by Lawhound. I have been dealing with Steph who took the time to learn and ask about my new business which is something of uncharted territory for both of us. She walked through my business processes and model and anticipated issues that could be cleared up in advance in contract terms and other key documents. This required a bespoke solution starting with a blank sheet of paper and together we developed a set of documents tailored to my specific needs. In practical t…
Law Hound has done perfect and accurate job for me, would definitely recommend their work, many thanks kamila.
Top class service by Law Hound! Thanks again!
Law Hound has provided legal advice to us for a number of years (including preparing our terms and conditions for both web development and ethical hacking). They take the time to explain legal terminology (so we in turn can explain it to clients) but more than anything They are a fantastic sounding board. Sensible advice, expertly delivered. Next time you’re about to do something you’ve a question about, ask yourself “what would Law Hound say?” Then call them. Highly recommended.
Law Hound grasped what we were trying to achieve very well and worked with how we wanted the documents to look, turned the work around very promptly and to a high standard. Will definitely use again.
Really great. Friendly, helpful and knowledgeable. Exactly what you need. Thanks LH
Sue has provided invaluable online services to a new business we started a few years ago. She is a true professional and simply brilliant with her pro-active advice and wide range of online support services. I give her my highest recommendation! Professor Bill Kapila
Very professional, friendly, helpful and knowledgeable. Highly recommended.
Direct and to the point. Thanks for including the resources for download, they’re helpful.
I can’t recommend LH Group highly enough. They take loads of time to explain in layman’s terms what’s going on and produce quick and efficient results.