Why has my mother not asked me to opt in?

20 July 2018


If, like me, your inbox was cluttered with so called “opt in” marketing emails in the run up to 25th May in the rush to comply with the new General Data Protection Regulation, you would be forgiven for thinking that this was a good opportunity to filter out the emails which you had been receiving offering you novelty tea towels since you made the mistake of purchasing one as a Christmas present circa 1992.

Unfortunately however, many of the marketing emails which I had hoped to opt out of due to my failure to respond have continued to fill my inbox.How so I hear you ask? How can I continue to be contacted if I have not positively opted in?Just as the title of the article suggests, and like my mother, businesses have concluded that consent is not the only justification that they can rely upon to make contact with you to offer their wares.

Now that the dust is beginning to settle and businesses have realised that people have chosen to ignore their “opt in” emails, it has been necessary for them to consider other ways in which they might legitimately market under the General Data Protection Regulation. The most common of these is relying upon having a “legitimate interest” to do so, provided that the Privacy and Electronic Communications (EC Directive) Regulations 2003 have been satisfied.

So how can you opt out of receiving emails that you no longer want?

The first option is that you can contact the organisation and withdraw your consent to them processing your personal data for marketing purposes. Assuming there are no other legal grounds for processing that data (which is unlikely in my example of a one-off purchase of a novelty tea towel), then the organisation must stop sending marketing emails to you. However, this does not mean that the company or business has to delete all data which they have collected about you. The company can still retain your contact details if they have some other legal basis for doing so, such as if it is necessary in order to fulfill their contract with you. For example, you can opt out of marketing emails from an airline but they will have a legitimate basis for retaining your contact details in order to keep you updated about any upcoming flight you have booked with them.

The second option is that you can rely upon your right to erasure. This right provided by the Regulation is more extensive than simply opting out of marketing emails.You can make a request to a company (verbally or in writing) to have it delete all the personal information which it holds about you. However, this is not an absolute right and it will only apply in certain circumstances, for example if it is no longer necessary for the company to process your data for the reason for which it was originally collected; if the business has no legal basis to hold the data other than your consent; or if there is no overriding legitimate interest for the company to continue processing the data.

On a separate note to businesses, although the flurry of opt-in emails has ceased and many businesses consider they have “ticked the GDPR box”, it is important to continue to take stock of how you collect, process and store data. The 25th May 2018 was not “d day” but rather the beginning of an ongoing process.