Elizabeth Denham attempts to set the record straight on consent
18 Aug 2017
This second ICO blog post focusses on the consent legal ground for processing personal data under the General Data Protection Regulation (GDPR).
There are six legal grounds for processing personal data in the GDPR but marketers are only likely to make use of two of those legal grounds for their data –driven marketing activities. One is consent and the other is legitimate interest.
Depending on the context a marketer may need to go down the consent legal ground but in other situations the legitimate interest legal ground may be more appropriate.
And, there is not a black and white answer as to which legal ground a marketer chooses. Both legal grounds are equally valid.
However, as the Information Commissioner says in her blog post, many organisations appear to believe that the GDPR requires them to go down the consent legal ground in order to process personal data. Elizabeth Denham states that this is a myth.
She said: “I’ve heard some alternative facts. How ‘data can only be processed if an organisation has explicit consent to do so’
“The rules around consent only apply if you are relying on consent as your basis to process personal data.
“So let’s be clear. Consent is one way to comply with the GDPR, but it’s not the only way.
“Headlines about consent often lack context or understanding about all the different lawful bases businesses and organisations will have for processing personal information under the GDPR.”
That said, the lack of guidance from the ICO has had many marketers fretting about where to start with choosing a legal ground and what they are actually allowed to do.
The Information Commissioner advises that while the final GDPR consent guidance is due for publication in December it is unlikely to dramatically change from the draft version.
The DMA had a number of concerns with the draft guidance so hopefully this is not a sign the ICO is not still open to industry’s arguments. The draft version can be accessed via
In summary, marketers can choose which legal ground under the GDPR they want to use for their data driven marketing activities, depending on the context and other legal requirements for particular channels under for example ePrivacy legislation. All six legal grounds for processing personal information under the GDPR are equally valid. Marketers will be able to make use the legitimate interest legal ground for their data – driven- marketing activities, provided they meet all the GDPR requirements for using this legal ground and other legal requirements.
For further information, you may want to listen to recordings of our previous GDPR webinars at https://dma.org.uk/webinars.
Guidance has been produced on the legitimate interest’s legal ground at
https://dma.org.uk/article/legitimately-using-legitimate-interests-new-guidance
Please login to comment.
Comments