Report comment

But as the requirements for contents of the privacy notice (formerly the fair processing information) have so drastically changed/increased under GPDR, you can't realistically 'fairly process' any data (even if you are relying on 'legitimate business interest' which itself is now subject to an additonal balancing test against the data subject's right to privacy) unless you contact the subject to provide them with an updated privacy notice.

As you have to get in touch with them anyway, you may as well seek a consent 'refresh' at that point.

But, if you don't have existing consent and it's a personal email address
or mobile phone number, you'd be in breach of the PECR just by contacting them and asking for consent (as that is 'marketing') under PECR. The PECR is the killer regulation for electronic marketing and. aside from the soft opt-in (for use only by exactly the same company which has had previous dealings in the same or similar field with the data subject) or actual consent it stops e-marketing to consumers dead.