18

I just received an unsolicited email from a company that wanted to sell me their services. They claim they do "Functional Service Provision (FSP)", whatever that is, tailored for biotech companies. I am a C-level employee of a biotech company, but have never interacted with or requested anything from these people. Their spam contained the following disclaimer:

Disclaimer

You are receiving this email under ‘Legitimate Interest’ as defined by the General Data Protection Regulations. If you do not wish to receive any further emails from us, please reply to this email with the words ‘Opt Out’ in the subject line and we will ensure you do not receive further emails.

I am based in the UK, but the spammer is in the Republic of Ireland. I realize the GDPR isn't relevant anymore to the UK, but it is relevant to Ireland.

Does the above disclaimer make sense? Can spamming random (or, at best, semi-random; yes I am in the field, but no, I did not ask for this and no it isn't actually relevant to the part of the field I am active in) people come under Legitimate Interest? Why?

Ideally, I would like an answer for my specific case: I am a UK resident, but an EU national (Greek). If that is too complex, we can ignore the UK side and imagine I were resident in the EU. Either way, is there any legal basis under which Legitimate Interest permits outright spamming like this?

Improve this question
14
  • 3
    There's now the EU GDPR, and the UK has the UK GDPR + DPA 2018. In this case, they'd all apply (EU company so EU GDPR applies, but targeting people in the UK so UK law also applies) But this is more a question about the anti-spam provisions in the UK's PECR (originally implemented from the EU's ePrivacy directive). See the ICO guidance on B2B marketing, which notes that "corporate subscribers" are not protected from spam mail: ico.org.uk/for-organisations/…
    – amon
    Commented Jul 31 at 13:56
  • 2
    @amon but I did not subscribe, this was sent to my personal work address not a generic company one. It seems that a subsequent clause there is more relevant: "If you collect an individual’s contact details in their business capacity and you intend to send them direct marketing messages, you must tell them about this and have a lawful basis under the UK GDPR for the processing.".
    – terdon
    Commented Jul 31 at 13:58
  • 8
    Never 'opt out' of spam emails. Block them.
    – Weather Vane
    Commented Jul 31 at 20:39
  • 5
    @amon Just because I work for a company and I use the internet, that makes me a subscriber? To what? I am not a customer of the spammer, I am a prospect. This was sent to my email, which is not publicly available and I had not given my consent to be contacted. It wasn't sent to a generic company address (e.g. [email protected]), it was sent to me. From your link: "If you collect an individual’s contact details in their business capacity and you intend to send them direct marketing messages, you must tell them about this and have a lawful basis under the UK GDPR for the processing."
    – terdon
    Commented Jul 31 at 22:52
  • 3
    @terdon: It's a good working assumption that nothing claimed in unsolicited commercial e-mail is true.
    – John Dallman
    Commented Aug 1 at 14:37

2 Answers 2

Reset to default
31

No.

"Legitimate interest" does not mean "I think I can get a few euros out of it" or "I feel like using your data for whatever I like." It means that it is necessary for the data operator, for a legitimate reason.

For example, it could be to inform you of changes to the T&C of the site, to warn you that your account is about to expire, to verify that you are actually who you claim to be, to inform you of a data breach... and similar.

A giveaway is that they claim that you are offered an opt-out. A legitimate interest would not give you that option, because it is something that the business must use your data for.

They are clearly trying to mingle "legitimate interest" with "consent", while they are two very different concepts.

And, regarding:

I am based in the UK, but the spammer is in the Republic of Ireland. I realize the GDPR isn't relevant anymore to the UK (right? They've made such a mess of things, I am not really sure anymore), but it is relevant to Ireland.

If the data processor is in the EU, they are required to comply with GDPR, even if you were a British citizen living in the UK.

https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm

Also IIRC, GDPR was transposed into UK laws. So you will not have it by that name, but probably there is something very similar to it.

Improve this answer
3
  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on Law Meta, or in Law Chat. Comments continuing discussion may be removed.
    – Dale M ♦
    Commented Jul 31 at 21:56
  • "A giveaway is that they claim that you are offered an opt-out" may be wrong as it looks like a GDPR requirement. The 2016/679 GDPR says "(69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. ..."
    – Henry
    Commented Aug 2 at 0:55
  • "GDPR was transposed into UK laws. So you will not have it by that name, but probably there is something very similar to it." - it's called the UK GDPR, and it's defined at Sections 3(10) and 205(4) of the Data Protection Act 2018. It's essentially the same as the GDPR but with some minor modifications. The full text, with the modifications incorporated, can be read here.
    – JBentley
    Commented Aug 5 at 21:25
3

Probably, but maybe not

The UK's Information Commissioner's Office has this to say about the UK GDPR and direct marketing. I've pulled out some quotes which I think reflect the whole but you may wish to read the whole thing

Can we use legitimate interests for our marketing activities?

Yes, in some cases, but you need to apply the three-part test and ensure that you comply with other marketing laws. Recital 47 of the UK GDPR says:

“…The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”

This means that direct marketing may be a legitimate interest. However the UK GDPR does not say that direct marketing always constitutes a legitimate interest, and whether your processing is lawful on the basis of legitimate interests depends on the particular circumstances.

Reading on down, you get to a table giving an overview of when they may or may not engage in such marketing, and it comes down to whether they have gained "soft opt-in" - this is that they've told you that your data may be used for marketing. You say you haven't dealt with these people, I think it's much more likely that you have dealt with some other part of the same business since many biotech companies share ownership.

Moreover, although you say it has come to your private email, it seems to me more likely that the company is attempting to contact you in a business-to-business way and simply has your private email on record because you used that email to contact them (or another company in the group) in some prior situation, in which case the next section of the guidance applies:

Can we use legitimate interests for our business to business contacts?

Yes, it is likely that much of this type of processing will be lawful on the basis of legitimate interests, but there is no absolute rule here and you need to apply the three-part test.

You are still processing personal data when you are using and holding the names and details of your individual contacts at other businesses. You must have a lawful basis to process this personal data.

So there is no clear cut is/isn't legitimate interest line regarding direct e-mail marketing. It depends on the exact circumstances, and the circumstances under which they obtained your email.

Improve this answer
2
  • 5
    I think we need to be clear that "Maybe" only applies if you already have a business relationship, which the OP doesn't appear to have.
    – MikeB
    Commented Aug 1 at 11:40
  • 1
    @MikeB I think it's much more likely that they're wrong about having not given their email, for the reasons I gave. Maybe it's not legitimate interest but, as the guidance referenced makes clear, it probably is. Particularly as it appears to be business to business.
    – Jack Aidley
    Commented Aug 1 at 19:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .