What are the legal bases for email marketing under the GDPR?
Every time you process personal data, it is an infringement on the privacy of the people concerned. That is why you may only process personal data if you cannot achieve your goal without this data. As an organisation, you must therefore have a good reason for doing so.
The General Data Protection Regulation (GDPR) lists six such reasons: the lawful bases. For each processing activity, you must be able to demonstrate which legal basis applies. This can be unambiguous and recorded consent, as well as a (sales) contract or the legitimate marketing interest of an organisation. Consent is therefore not the only legal basis you can have. You can record which legal basis you use in a record of processing activities.
Processing personal data purely for personal use is permitted. Examples include a birthday calendar or a file containing the addresses of family and friends.
Rules for email marketing
With email marketing, you send emails to a group of recipients with a specific goal. Examples include promoting products or services, building and maintaining relationships with customers, members or interested parties, providing information via a newsletter, or encouraging people to take action (filling in a form, visiting a website, and so on).
To be allowed to contact people, you always need a valid legal basis, such as consent or an existing customer relationship. In addition, there is legislation for email marketing that prevents people from receiving unsolicited emails (spam or even phishing emails). Three aspects are important in this regard:
- Consent from the recipient: this can be explicit, where the recipient actively agrees to receive emails, or implicit, for example in the case of an existing business relationship.
- Transparency and identification: commercial emails must be clearly recognisable as advertising and the sender must be correctly identified.
- Opt-out option: recipients must always be able to unsubscribe (opt out) from further communication. This unsubscribe option must be easy to find and use.
The Netherlands Authority for Consumers and Markets (ACM) explains this in Spam voorkomen in uw reclame.
When are you allowed to send subscribers a newsletter?
The conditions under which you are allowed to send emails based on this data are laid down in the Dutch Telecommunications Act (Telecommunicatiewet). This law did not change with the introduction of the GDPR. Compared to the previous law (Wbp), there are therefore no substantial changes: it is still permitted to call a person or organisation or send them post with an offer without having permission to do so.
You cannot simply do this by email. For that, you need one of these two legal bases:
If you are not sure whether the permission from your existing subscribers still meets the requirements, read when you need to ask subscribers for permission again.