1

I work on a SaaS website offering both free, and paid subscriptions to B2C customers. On it, I collect statistics, and emails(subscribed and double-opt-in users only)

As far as newsletters and marketing emails go, I understand those require re-approval to be allowed.

My question, is for the types of emails below. Under what circumstances can I send them without specific approval? (Besides on the terms and conditions):

  1. Service outage and maintenance announcements(Can I send to my entire emails list?)
  2. Terms and Privacy Policy updates
  3. New Feature Announcements(something new the site can do) that are relevant to the current user(or for most users, does the specificity matter?)
  4. Notifications about account status changes(like an existing paid feature being made free for the user)
  5. Security notices
  6. Personal contact with users(for example for surveying them)

Thank you in advance

2

It depends. I know that's a cop-out, but it really does.

First, let me challenge you on marketing emails requiring re-approval: that's not the case. Data processed for the purposes of direct marketing needs a way for the user to be able to object to it, in which case you must stop, but that's not the same as required to opt-in again.

On to your question. IANAL(and you should consult one within your company) but a lot of your question to me seems to fall on what are the lawful basis you are using to process the data, what your privacy notice is, etc.

For example, if you are relying on "contract", and it is implied your customers are paying you to provide and notify them of security notices, then asking consent for this would be silly (but there are other rights you would have to be aware of)

In practice, as long as you are honestly and clearly telling users what you are doing with their data when you collect it (or soon after), giving them access when appropriate and holding it securely, you probably won't go far wrong.

Remember what the UK ico says:

The GDPR sets a high standard for consent. But you often won’t need consent. If consent is difficult, look for a different lawful basis. Consent means offering individuals real choice and control. Genuine consent should put individuals in charge, build trust and engagement, and enhance your reputation.

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/

Edit: Additional Information on Consent

As mentioned, you may not need to get consent. This is all about the 'Lawful basis' you use for processing the data. Consent is only one of several available options, and should often be avoided where possible.

The UK ICO even has a couple of blog post about this: https://iconewsblog.org.uk/2017/08/16/consent-is-not-the-silver-bullet-for-gdpr-compliance/

https://iconewsblog.org.uk/2018/05/09/raising-the-bar-consent-under-the-gdpr/

Quoting from the second link:

Myth #9 We have to get fresh consent from all our customers to comply with the GDPR.

You do not need to automatically refresh all existing consents in preparation for the new law. But the GDPR sets the bar high for consent, so it’s important to check your processes and records to be sure existing consents meet the GDPR standard. If they do there is no need to obtain fresh consent.

Where you have an existing relationship with customers who have purchased goods or services from you it may not be necessary to obtain fresh consent.

And remember, if you use consent, that means you need to give the people option to withdraw it: Can you still operate an effective service for your customers if you cannot send service outage and maintenance announcement emails?

I cannot advise you on the your buisness without knowing a lot more about your processing, but it sounds to me like you might be relying on the 'Contract' basis more:

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/contract/

But be aware that you may need different basis for different things, for example, you may need to rely on consent for things like profiling done under your surveys.

  • David, can you address your first paragraph further, please? I'm receiving numerous emails asking for re-approval from various companies, etc., that I've received emails from before. Further, with regard to my Mailchimp email list that I referenced in my own question yesterday, Mailchimp has guidelines for obtaining re-approval. That doesn't seem to jive with what your first paragraph says and I was hoping you could elaborate. – A.fm. May 24 '18 at 13:44
  • @A.fm. Sure, There are lots of people 'playing it safe' but it's not strictly necessary in many cases. I'll edit the question and add some references now. – David May 24 '18 at 13:48
  • @A.fm. That said, there's no harm in reconsenting apart from having a reduced subscriber list of people that actually want to engage with you, which could indeed be a good thing. – David May 24 '18 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.