0

I need to set up a registration form for an event in which the main communication channel between the registered users and the organizers is the e-mail. E-mails could be sent before, during and after the event with informative purposes about such event (i.e. no marketing).

Basically the registration is not possible if the user doesn't want to receive e-mails. For instance, just after the sign up the user would receive a confirmation e-mail.

What should be the canonical way to grant the permission to send e-mails to the user according to GDPR in this case?

If I understood it well, putting a notice like Signing up this event you also consent to receive informative emails from us about the event would not satisfy the regulation about active consent.

Should it be better to give the user the option to agree to receive e-mails, e.g. through option-buttons (e.g. Do you agree to receive e-mails from us to keep you informed about the event — ○ Yes / ○ No) and then refuse to register the user displaying an error message like Sorry, we cannot handle your registration if you don't allow us to send e-mails to you?

|improve this question|||||
  • 1
    Don't ask for permission. Article 6(1)(b) applies which allows you send email when it is necessary for the performance of a contract. However you should explain why it is required. As you already said, those emails should not include marketing related content. And you should think about whether it is possible for someone to leave before the event is over, so that person does not need any further emails. – wimh Jun 12 '18 at 20:49
  • This isn't sufficient. OP, you should in all likelihood seek the consent as you had originally thought. According to the UK's ICO, "[t]he processing must be necessary to deliver your side of the contract with this particular person. If [it] is only necessary to maintain your business model more generally, this lawful basis will not apply..." You could go with legitimate interests if you're able to meet that standard. However, contract performance will almost certainly be inapplicable to emails sent after the event and probably wouldn't apply to emails sent during the event. – A.fm. Jun 13 '18 at 18:50
  • For consent, as you stated, OP, it must be given with affirmative actions, like the yes / no question you presented. – A.fm. Jun 13 '18 at 18:51
1

Basically the registration is not possible if the user doesn't want to receive e-mails. For instance, just after the sign up the user would receive a confirmation e-mail.

In this case Article 6(1)(b) applies, the data processing is necessary for the performance of a contract. So you do not need separate permission. You cannot use the e-mail address for other incompatible reasons though.

I have the impression you talk about an online event. But if it would be a real-live event where people meet, I can imagine other reasons to use the email address. For example if some people get ill after the event, you might need to warn all attendees to immediately visit a doctor if they also have certain symptoms. Art. 6(1)(d) would apply in that case. If that is a legal obligation, Art. 6(1)(c) would apply too. In all those cases you don't need consent, however, you do need to inform users.

If I understood it well, putting a notice like Signing up this event you also consent to receive informative emails from us about the event would not satisfy the regulation about active consent.

This will not be valid consent as specified by the GDPR, Article 7(2) specifies that a request for consent must be separate from other matters.

Sorry, we cannot handle your registration if you don't allow us to send e-mails to you?

This is not allowed. If you ask for consent, it must be freely given. See Article 7(4).

You already said you will not send marketing mail, but if you would use e-mail for marketing reasons, special conditions apply, including the possibility to unsubscribe in every email.

If you would force users to receive marketing email, because you finance your event that way, your business model would be incompatible with the GDPR. Because there is no (technical) reason to receive such a mail, consent is required, and it must be possible to withdraw at any time (Article 7(3)).

|improve this answer|||||
  • Yes, it is for a real life event. Thank you for your remarks about exceptional uses of the e-mail and the organisers' rights and duties about that. That is more clear now – etuardu Jun 18 '18 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.