Email marketing is used by most companies that engage in online marketing at the moment. As a result, there has been much debate over what is legal and what is not under the GDPR. Do we need re-consent for our newsletter mailing list? Can I send my marketing emails to those who buy something from me? Is consent the only way, or are there are legal grounds for marketing? These are only a few of the questions that came up since the discussions around the GDPR begun.

The general idea is to begin by treating direct marketing like you would any other form of data processing and make sure you have a strong legal basis for processing. In many cases, this could be consent, especially in the case of newsletters. It is disputable if using incentives to get people to subscribe is compliant to the GDPR. There are those who say it isn’t. But there are also the supporters, who believe that as long as you make it clear to the user that they are not only giving their email address to receive something - like an e-book or a brochure - but they are actually subscribing to your newsletter you will be compliant. Of course, always add the option to opt-out of your emails. Another option, if you want to use incentives, could be to add an additional check-box where that the user has to check if they actually want your newsletter, or just the one-time “gift”.

According to Art. 21 of the GDPR, the data subject always has the right to object to processing for direct marketing purposes. The controller has to stop any processing activities immediately, upon receiving such a request. However, this is not equivalent to an erasure request. If the data is needed for other purposes, such as fulfillment of a contract, the controller can still process the data, but only for the specified purposes, not for direct marketing.

An alternative to consent for direct marketing is legitimate interest, something that can be used in some circumstances, especially for existing clients. The right to object applies however, regardless of the legal grounds for processing.

Articles: 6,7,21,95

Recitals: 32,33,39,40,41,42,43,47,171,173