28 January 2025
We’ve Improved Our Privacy Policy: By ‘Improved,’ We Mean for our Marketing
By Jess Pembroke, Director of Information Law Services
Why privacy notices are important
“Privacy Notice”, “privacy policy”, “privacy statement” whatever you want to call them are an important legal requirement but sometimes infuriating component of the world of General Data Protection Regulation (GDPR) compliance. Although none of these terms are used in the Regulation; Recital 39 states that: “any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used.”[1]
These public facing documents are therefore important tools in articulating how and why personal data is being processed. In this post, I discuss how they can vary from mildly useful to convoluted meaningless jargon, the typical mistakes I come across and the legal, business and trust ramifications of “miscommunication”.
My experiences of privacy notices as a consumer and a data protection expert
As a consumer I do (occasionally) read them, and as a data protection professional I find them a good blunt tool for giving me an initial impression of the data protection compliance levels of an organisation I am dealing with (FYI If I ask your company for either a Data Protection Policy or a Data Processing Addendum and you just send me a link to your privacy notice that isn’t a good start). So, when I recently received a personal email titled “We’ve updated our Privacy Policy” from a company whose products I like (no I won’t be naming and shaming them) I gave the email a quick read. Disappointingly this company has made a bit of a blunder, and to be honest I am not sure why they chose to tell me about it.
The email from this subscription company said, “We have updated the legal basis that we are using for opt-ins: as someone who has shopped with us, we will process your contact data for legitimate interests like marketing and improving services, unless you opt out”. Immediately I can see that what they want to do here is rely on the Soft-opt in from the Privacy and Electronic Communications Regulations (PECR),[2] which would be fine (if I was a new consumer buying their products) but as an existing customer who hasn’t shopped with them for a while this isn’t allowed, as the original legal basis for marketing to me was consent.
In their keenness to comply with the first data protection principal “Fairness”; they’ve tripped over the second one the principle of “Purpose Limitation”. The GDPR states that personal data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. If the purposes for processing data change over time, companies must ensure that any new purpose is compatible with the original purpose, or they must obtain specific consent for the new purpose.
Can an organisation change from using Consent to Legitimate Interests?
The short answer is no; although the legal basis of legitimate interests allows processing when it is necessary for activities such as marketing (provided that these activities are not overridden by the rights and freedoms of the data subjects) the issue here is changing from consent to a different legal basis. If I was a new customer purchasing a subscription, (because of the soft-opt in within PECR) it would be acceptable for the company to rely on legitimate interests but this is not the case for existing customers.
The term ‘soft opt-in’ is sometimes used to describe the rule about existing customers. The idea is that if an individual bought something from you recently, gave you their details, and did not opt out of marketing messages, they are probably happy to receive marketing from you about similar products or services even if they haven’t specifically consented. However, you must have given them a clear chance to opt out – both when you first collected their details, and in every message you send.[3]
And
“If e-privacy laws do not require consent, legitimate interests may well be appropriate. Based on the current legislation (PECR), and depending on the outcome of your three-part test, legitimate interests may be appropriate for ‘solicited’ marketing (i.e. marketing proactively requested by the individual), or for unsolicited marketing in the following circumstances: Emails/text messages to individuals – obtained using ‘soft opt-in’”[4]
However, the issue here is not which legal basis they are using but that they are swapping from one to another. It is possible to change legal basis; this would need a compatibility assessment,[5] but this cannot be done when consent was the original legal basis. Consent means giving individuals real choice and control over how their data is used. In this case the company relied on my consent, and I had agreed to that use of my data for marketing purposes – I was given a choice; switching to legitimate interests after initially relying on consent has undermined my control and the agreement I made with this company.
When I contacted the company to raise this, they didn’t give me a straight answer but confirmed I could object and withdraw from receiving marketing.
What should the company have done?
Consent is one option for sending marketing messages, it may be less convenient for some marketing campaigns to give people a choice as perhaps lots of people chose not to tick that box, but it is a valid legal basis and the only legal basis if a company is not able to rely on the soft-opt in from PECR. The company in this case should have continued to rely on consent for any data subject who had been presented with the option of consenting to receive marketing, for any new customer, they could have updated their privacy notice and started relying on legitimate interests. This is more complicated for the company to administer; however, it would be the correct approach under the GDPR.
What’s the real issue here?
There isn’t anything wrong with the company using legitimate interests to send marketing messages for new customer, so I’ve asked myself if I can opt out either way, why does this matter to me. I think the answer can be found in the fundamental tenants of the GDPR which states that (emphasis added):
“The processing of personal data should be designed to serve mankind…This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life…”[6]
When considering “respect”, as a consumer I felt that this company has got my data and what they are saying is we want to use it more freely, so we are taking away your choice. In addition to this, this message interrupted my “private and family life”, this message was of no benefit to me, and the only purpose was so the company could say “we have informed people we changed our privacy notice” but actually, they did not have justification to change their legal basis, never mind inform me about it.
We consumers face a constant barrage of marketing messages invading our personal space. The digital age has led to unprecedented levels of targeted advertising, which, while personalised, can feel intrusive and overwhelming. These communications can disrupt family dinner and personal time, incessant marketing can intrude on leisure activities, creating a sense of being constantly “sold to” even in the sanctity of one’s home.
In addition, this overload of messages can lead to digital fatigue and a sense of being overwhelmed, the email actually stated “What do I need to do? – No action is required from you” so why even contact me in the first place!.
Quality privacy notices matter
Effective privacy notices are a cornerstone of building trust with customers. When businesses are transparent about how they handle personal data, it reassures customers that their privacy is respected and protected. This transparency fosters a sense of security and loyalty, encouraging customers to engage more freely with services. Moreover, a well-crafted privacy notice can showcase commitment to data protection good practices.
Ready to take your privacy practices to the next level? Our comprehensive training courses are designed to equip you with the knowledge and tools to create robust privacy notices that build trust and drive business success.
If you would benefit from a refresh on data protection practices, please join our course “Data Protection Essentials: An Introduction 10 & 11 Feb 2025 – 9:30am-1pm Tickets, Mon 10 Feb 2025 at 09:30 | Eventbrite”
Or don’t make the same mistake as the company in this example and come on our fantastic course “Lawful Digital Marketing and Consent 25 March 2025 – 9:30am-1pm Tickets, Tue 25 Mar 2025 at 09:30 | Eventbrite”.
Find out more about assessing the maturity of data processors in our course “Information Sharing, Data Processors and Contracts 4 Feb 2025 – 9:30am-1pm Tickets, Tue 4 Feb 2025 at 09:30 | Eventbrite”. Each of our intermediate courses can be taken as an individual course or as part of our Intermediate Certificate (available in Copyright and in Data Protection). Book any of our courses via the links above, our Online Training Page; https://www.eventbrite.co.uk/o/naomi-korn-associates-30026637384, or contact our Training Manager at info@naomikorn.com.
[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation)(Text with EEA relevance) (39)
[2] The Privacy and Electronic Communications (EC Directive) Regulations 2003
[3] Electronic mail marketing | ICO
[4] When can we rely on legitimate interests? | ICO
[5] What else do we need to consider? | ICO
[6] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation)(4)