Q&As

Which of the General Data Protection Regulation (GDPR) lawful grounds might be appropriate for processing the personal data of entrants to a prize competition? Does the answer differ if the data may subsequently be used for direct marketing purposes?

read titleRead full title
Produced in partnership with Helen Hart of Institute of Promotional Marketing
Published on LexisPSL on 19/08/2019

The following TMT Q&A produced in partnership with Helen Hart of Institute of Promotional Marketing provides comprehensive and up to date legal information covering:

  • Which of the General Data Protection Regulation (GDPR) lawful grounds might be appropriate for processing the personal data of entrants to a prize competition? Does the answer differ if the data may subsequently be used for direct marketing purposes?
  • Performance of a contract
  • Legitimate interests
  • Consent
  • Direct marketing

This Q&A assumes that the prize competition is a sales promotion for consumers, rather than a trade promotion or other type of competition. A controller can only lawfully process personal data in compliance with the lawfulness, fairness and transparency principle under Article 5(1)(a) of Regulation (EU) 2016/679, the General Data Protection Regulation (the GDPR) if it satisfies one of the six conditions set out in Article 6(1) of the GDPR. See Practice Notes: Data protection principles and Lawful basis for personal data processing.

The three conditions relevant to prize promotions are:

  1. processing is necessary for the performance of a contract to which the data subject is a party

  2. processing is necessary for the purpose of the legitimate interests pursued by the controller or a third party

  3. the data subject has given consent to the processing of their personal data for one or more specific purposes (see Practice Notes: Processing personal data—standard of consent and Processing personal data—obtaining, recording and managing consent)

For more information on the GDPR, see Practice Note: The General Data Protection Regulation (GDPR).

Performance of a contract

This condition covers processing that is necessary for the performance of a contract to which the data subject is a party or which is necessary to take steps at the request of the data subject before entering into a contract.

The contractual basis is likely to be the primary

Related documents:

Popular documents