Q&As

Do I have to refresh marketing email consent obtained by a pre-ticked box on our website?—law firms

read titleRead full title
Published on LexisPSL on 11/04/2018

The following Risk & Compliance Q&A provides comprehensive and up to date legal information covering:

  • Do I have to refresh marketing email consent obtained by a pre-ticked box on our website?—law firms
  • Lawful ground for processing under the GDPR
  • Compliance with PECR 2003
  • Where does this leave you?

Do I have to refresh marketing email consent obtained by a pre-ticked box on our website?—law firms

See Practice Note: Processing personal data—direct marketing—Email, messaging and text marketing.

This explains that, to engage in email marketing, you will need:

  1. a lawful ground for processing under the General Data Protection Regulation (GDPR), and

  2. to comply with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR 2003)

See also Flowchart: Direct marketing decision tree—email and other electronic marketing—data protection, which walks you through the decision making process in relation to email direct marketing, including whether you need consent. This Flowchart takes account of the GDPR and PECR 2003.

Lawful ground for processing under the GDPR

Your two realistic lawful grounds for direct marketing processing under the GDPR are consent and legitimate interests.

The GDPR has raised the bar for getting consent generally. Consent must be freely given, specific, informed and unambiguous. Consent requests must be separate from other terms and conditions and require a positive action to opt in.

Opt-out consent is not permitted under the GDPR. This does not, however, mean you automatically have to obtain consent again. Many firms will prefer to rely on legitimate interest as the lawful basis for direct marketing activities under the GDPR.

Recital 47 of the GDPR acknowledges that processing personal data for direct marketing purposes may be regarded as carried out for a

Popular documents