GDPR: Do you need B2B marketing consent?

As the enforcement date for the GDPR looms closer, my inbox is being bombarded with requests for my B2B marketing consent. Many of these opt-in emails are unnecessary. Most B2B marketers can rely on ‘legitimate interests’ as a lawful basis for processing personal data under the GDPR and do not need to obtain opt-in consent.

GDPR Article 6 – Legitimate Interests for B2B marketing consent

Article 6 sets out six legal grounds, lawful bases, for using personal data. The final lawful base is as follows:

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

You can rely on legitimate interests for marketing activities when:

  • the processing is not required by law but is of a clear benefit to you or others;
  • there’s a limited privacy impact on the individual;
  • the individual should reasonably expect you to use their data in that way; and
  • you cannot, or do not want to, give the individual full upfront control (i.e. consent) or bother them with disruptive consent requests when they are unlikely to object to the processing.

Useful GDPR resources

For more information and clarification, the following resources are useful:

DMA – “Guidance on the use of Legitimate Interests under the EU General Data Protection Regulation

ICO – “Direct Marketing Guidance

ICO – “For organisations/Guide to the General Data Protection Regulation (GDPR)/Lawful basis for processing/Legitimate interests

While B2B marketers can seemingly breathe a sigh of relief, for now, the Privacy and Electronic Communications Regulations (PECR) with specific rules on email marketing are currently under review. A change to these regulations may change the landscape for B2B marketing consent.