The Information Commissioners Office, the body that oversees implementation and adherence to GDPR, has updated its guidance on what constitutes legitimate interest. The move has been welcomed by the Data Marketing Association as it clarifies where consent is and isn’t required before targeting individuals with marketing material.
The DMA says: “Legitimate interests was one of the key areas where the association led sustained lobbying and member engagement doing the passage of the legislation. The updated guidance now reflects a more practical commercially realistic approach in areas that have long mattered to the sector, particularly around direct marketing, proportionality, accountability and the need for organisations to justify their decisions properly.”
It calls the revised guidance “a constructive step forward” and “the right balance” adding: “It supports innovation and responsible growth, but without lowering the standard expected of organisations handling personal data”.
The move expands what messaging can be sent to individuals as well as companies. Thus “commercial interests, third-party interests and wider societal benefits” are considered legitimate reasons, whether the ICO says these are compelling or trivial. This does not mean a free for all. Organisations must continue to balance their interests against the rights and freedoms of the individual.
Personal data must be used in a targeted and proportionate way, easing some of the restrictions that have been in place. This will be welcomed too by direct mail printers where the opportunity to use personal data to drive digital presses.
Prior consent to the use of personal data is no longer essential, but must be proportionate with minimal impact on privacy and is not something that individuals would be likely to object to our be surprised by. The guidance states: “In terms of the purpose test, some forms of direct marketing may not be legitimate if they don’t comply with other legal or ethical standards; or industry codes of practice.
“However, in most cases it’s likely that direct marketing can be a legitimate interest as long as you carry out the marketing in compliance with electronic marketing rules and other legal and industry standards.”
