Report comment

Please fill in the form to report an unsuitable comment. Please state which comment is of concern and why. It will be sent to our moderator for review.

Comment

I think the untold issue in this article is about the use of legitimate interest as lawful basis for consent. The marketing industry has taken a view that no consent is needed to process personal data for direct marketing purposes.
This is based on a rather doubtful reading of an equally doubtful line in the preamble to the regulation. The result of such interpretation is that consent, which is the normal requisite for processing data, is not needed for direct marketing when a self assessment, balancing the interest of the processing business against that of the data subject is made. If the assessment is made, the business can go ahead with processing subject to the data subject's right to erasure, etc.
I have read the documents published by the DMA and I completely disagree with how they interpret the law; I think it is unlikely that such interpretation will withstand a judicial challenge.
Personal data processing is a subject matter that has its foundations in human rights law, not private or commercial law. It can very rarely be the case that a business' interest to use personal data for its commercial purposes carries more weight than a person's right to only have her personal data processed with her express consent.
Consent is the general rule and it suffers limited exceptions under the GDPR. Allowing businesses to continue processing data as they have always done through the backdoor of legitimate interest (and through the fig leave of the self assessment) means to ignore the spirit and, I think, the letter of the regulation. The ambiguity of the ICO on this matter is sad to see.
I, for one, am eagerly waiting for someone to tell me that he/she is sending me marketing communications using my data on the basis of legitimate interest. But so far it seems that businesses are really being prudent about this.

Your details

Cancel