Direct Marketing - opt-out rules and exceptions

When you’re preparing for your CIPP/E certification exam, you will sometimes wonder about some specific rule, or exceptions to this rule, for which your book doesn’t give you a clear explanation. In a series of blogposts, I will explain those topics. Obviously, you’ll find the latest information in the 22Academy.com training courses.

Opt-out is a way for individuals to prevent companies from using their data for direct marketing. For example, if an individual does not want to receive emails or texts from a company, they can opt-out of those communications. In fact, the rules are that there can be no pre-checked boxes, and the data subject has to opt-in (with an affirmative action), if they do want to receive marketing messages.

Under the GDPR and ePrivacy Directive, companies must provide clear and easy ways for individuals to opt-out of direct marketing activities. The GDPR states that companies must offer an opt-in option before any data is collected, as well as give individuals the right to withdraw their consent at any time. This means that if an individual no longer wishes to receive emails or texts from a company, they can easily opt out without having to contact the company directly. The ePrivacy Directive also requires companies to provide individuals with an opt-in option, rather than an opt-out option, when collecting data for direct marketing purposes.

However, there are some exceptions to this right, which means that organizations can continue to send marketing messages to individuals, even if they didn't request to receive them.

The exceptions to the opt-out/opt-in request in relation to direct marketing under GDPR and ePrivacy Directive, are as follows:

1. Soft opt-in: The soft opt-in rule applies when an individual has previously bought a product or service from an organization, and the marketing message is related to similar products or services. In this case, the organization may send marketing messages without obtaining explicit consent from the individual, as long as they offer the option to opt-out in every subsequent communication.

2. Legitimate interest: Organizations can also send marketing messages based on their legitimate interest, such as when they have a legitimate reason for sending the message, and the individual would reasonably expect to receive such messages.

3. Public interest: Organizations can send marketing messages if it is in the public interest to do so, for example, when promoting public health campaigns or charity fundraising.

4. Contractual obligation: Organizations can also send marketing messages if it is necessary for the performance of a contract with the individual, such as when sending renewal reminders for insurance policies or subscriptions.

Of course, organizations must always ensure that they have a lawful basis for processing personal data for marketing purposes, and they must provide individuals with clear and easy-to-understand information about their marketing activities and the right to opt-out. Individuals must be given the opportunity to opt-out at any time, and their preferences must be respected.