'Most Innovative Startup 2020' by RSA - Watch the video

Learn More
Watch Demo

Blogs

Email Marketing Requirements under GDPR and e-Privacy Directive

Published on March 13, 2021 AUTHOR PRIVACY RESEARCH TEAM

Marketing communications via email is a form of direct marketing that is directed to particular individuals and is subject to the requirements of global privacy laws. With global data privacy regulations increasingly requiring organizations to obtain users’ consent before sending them any marketing communications, organizations must re-evaluate their email marketing practices.

Consent Under GDPR

According to a survey conducted by fastmap, 60% of individuals were unwilling  to sign up for company communications due to the belief of data mishandling. Also, the percentage of data fundamentalists is increasing at 8% per year, which could mean that this number can get a lot higher over time. The increase of people not willing to give consent to their data negatively impacts the marketing sector, since it shrinks the database of customers to target. It is important to capture consent, in order to engage and build trust with customers, in addition to meeting compliance.

Failure to comply with applicable marketing requirements may expose organizations to exorbitant amounts of fines. An example of this can be seen in August 2016, when Flybe sent out an email to 3.3 million of its customers in their database to verify their details. In theory, this sounds like a smart strategy, but unfortunately, these 3.3 million people had previously opted out to marketing emails and thereby gave no consent to be contacted. This resulted in a fine of £70,000.

This begs the question, what steps do organizations need to take in order to stay compliant. This blog looks into best practices of email marketing under the European Union’s General Data Protection Regulation (GDPR) and e-Privacy Directive. It further delves into what an organization must do when an individual opts-out and if there are any exception to when an organization can send marketing communications without the individual’s consent.

Email marketing best practices under GDPR and e-Privacy Directive

GDPR and e-Privacy Directive prohibit organizations from sending direct marketing communications to individuals without first obtaining their consent. Such consent must be freely given, informed, specific, and unambiguous. Typically, organizations obtain consent from individuals by presenting them a checkbox on their website asking whether they would want to receive marketing emails.

Let’s look into some of the best practices of email marketing for organizations that are aiming to comply with the GDPR and the e-Privacy Directive.

  • Positive Opt-In

Organizations must allow individuals to actively confirm their consent by taking an affirmative action, such as ticking an unchecked opt-in box. Such a checkbox must not be pre-selected or pre-ticked by default, and the individual must actively select it himself/herself.

  • Separate your Consent and Terms & Conditions

Organizations must ensure that an individual’s consent is specific to the purpose of sending marketing communications. Consent should not be bundled up as a non-negotiable part of the terms and conditions of a service or the organization’s privacy policy.

  • Simplify Consent Withdrawal

Organizations must provide an option to opt-out in every subsequent marketing email to the individual. This may be done by including language at the bottom of the marketing communication that instructs individuals how they can opt-out.

For example:

If you do not wish to receive further marketing emails from us, please click here.

The next question is what must an organization do when an individual opts-out.

  • It must not send those individuals any further marketing emails nor contact them to invite them to opt back into marketing,
  • It must delete the personal data collected for the purposes of sending marketing emails. However, an organization may suppress personal data only to ensure that those individuals are not sent any more marketing emails, unless they opt-back in at a later stage,
  • Suppression of personal data involves retaining just enough information to ensure that the individual’s preferences are respected in the future. An organization must always inform individuals about such suppression so that they may ask it to remove or delete their details entirely,
  • Honor the opt-out request promptly and avoid any unnecessary delay.

Soft opt-in exception

GDPR and e-Privacy Directive allow organizations to send marketing communications to individuals whose details they obtained in the context of the sale of a product or service without making them select an opt-in checkbox. This is referred to as the soft opt-in exception. To rely on soft opt-in exception and send marketing emails to individuals without their consent, the following conditions should be fulfilled:

  • The organization obtained the individual’s contact details in the context of the sale of its product or service,
  • The individual did not opt-out at the time of providing his/her personal data and a clear and distinct opt-out ability was provided to him/her,
  • The organization must send marketing emails only about its own products and services and similar products and services for which the individual’s details were originally collected,
  • The organization must clearly and distinctly remind individuals about their ability to opt-out at every subsequent marketing communication,
  • Opt-out should be simple, free-of-charge, both at the time of the collection of the personal data from individuals and in each subsequent marketing communication.

The interpretation of the term “in the context of the sale of a product or service” may differ from one member state to another.

In United Kingdom, the individual does not actually have to buy anything to trigger the soft opt-in exception but it should be enough if negotiations for a sale took place. For example, if an individual completes an online inquiry form asking for more details about a product or range of products, this should be enough to constitute negotiations for a sale since he/she has expressed an interest in buying the organization’s products or services. This means that anyone who registers for a webinar, tradeshow, or any event organized by the company can be reasonably expected to have their personal data processed for sending marketing communications and marketing emails, provided that such emails are related to similar products or services.

On the other hand, other member states of the European Union may take the stance that a transaction must take place in order to rely on the soft opt-in exception. Therefore, organizations are encouraged to look into specific requirements relevant to their jurisdiction.

Can an organization rely on a purchased marketing list for sending marketing emails?

Many companies capture cold leads from a purchased list from a third-party. However, buying and scraping marketing lists from another source is generally prohibited under the framework of the GDPR and e-Privacy Directive since it defeats the purpose of obtaining consent from the user. In such a situation, organizations must undertake due diligence on whether the individuals named in the marketing list consented to sharing their information with that particular organization and agreed to receive marketing emails. Organizations may cross-reference purchased marketing lists against their own “Do-Not-Contact” list of people who have previously objected to or opted-out of its marketing emails.

While relying on a purchased marketing list for sending marketing emails, an organization must inform the individual about its identity, contact details, the source from where it obtained their information, and if applicable, whether their details came from publicly accessible sources. All of this information must be provided to the individual upon first communication with the individual. In addition, an organization must always provide the option to opt-out.

However, where an organization is not sure whether individuals in the purchased marketing list consented to share their personal data for direct marketing purposes, it must not rely on such a list.

Email marketing requirements under other regulations

For countries that are not based on opt-in consent regimes such as the United States, organizations are allowed to send marketing emails without obtaining an individual’s consent. However, as a matter of best practice, the organization must always inform individuals that their personal data will be used for sending marketing communications and provide them the option to opt-out. Moreover, such organizations must honor opt-out requests promptly, thereby not sending any further marketing emails to individuals who have opted-out or contacting them to invite them to opt back into marketing.

How securiti can help these organizations and enable their marketing activities?

Using a consumers’ data without consent can land an entity into hot waters, as was the case with Google. The day GDPR went live, Google was sued by privacy rights groups for not obtaining valid consent to process its consumers’ data for ad serving and personalization. The case was handled by France’s data regulatory authority, Commission Nationale de l'informatique et des libertés, which ruled that Google disseminated information on how consumer data will be used across several documents and confused customers regarding how their data will ultimately be used. The result: Google was fined 50 million euros (£44m) for breach of GDPR’s consent acquisition clause, among others.

Data collection is growing and marketing companies are going to have a hard time managing consent for all this data. Securiti’s Universal Consent Management solution enables organizations to capture users’ consent and revocation fulfillment in an effective manner, advertise their products and services efficiently and compliantly, thereby respecting an individual’s privacy and avoiding any potential legal consequences.

The Universal Consent Management Solution streamlines the consent management process and helps organizations efficiently and adequately honor consent preferences across multiple systems.

Share this

Our Videos

universal consent thumbnail View More
02:37

Universal Consent & Preference Management

Universal Consent & Preference Management

Learn More
cookie consent management video thumbnail View More
01:53

Cookie Consent Management

Automate and manage the entire consent life cycle with efficiency for various cookie compliance regulations around the world.

Learn More
data intelligence thumbnail View More
3:06

Sensitive Data Intelligence

Discover granular insights into all aspects of your privacy and security functions while reducing security risks and lowering the overall costs

Learn More
data mapping video thumbnail View More
3:11

Data Mapping Automation

Simplify gathering information, dynamically update your data catalog, and automate assessments and reports

Learn More
View More
02:40

An IT Leader’s Perspective on CCPA

Meet Brian Lillie, Former CPO at Equinix as he discusses the potential challenges of CCPA and how the PrivacyOps framework can be the key to unlocking compliance.

Learn More
Most Innovative Startup 2020 SECURITI.ai View More
03:42

RSA Innovation Sandbox 2020: Securiti

Watch the 3-minute pitch presented by Rehan Jalil on SECURITI.ai in the RSAC Sandbox Competition

Learn More

Products

Solutions

Systems

Company

Resources

Terms

Get in touch

[email protected]
PO Box 13039,
Coyote CA 95013

Copyright © 2021 SECURITI.ai

Sitemap - XML Sitemap