Is it ok to assume a user has opted-in to receive emails in an application where the main purpose is sending notifications

Question

I originally posted this on another Stack Exchange website but was advised this might be a better place for it. Original is here: https://security.stackexchange.com/questions/215300/is-it-ok-to-assume-a-user-has-opted-in-to-receive-emails-in-an-application-where/

I'm working on a web application where the main purpose/functionality is notifying users when there have been changes to regulations in a particular industry. The content of the email is always related to specific legal changes that have occurred. The users are not being "sold" anything from the content of the email, it contains factual information only.

The application is subscription based, i.e. you have to pay for an account and using it is a choice. Any email addresses for accounts we hold are active users and we do not harvest this data from anywhere. So all email addresses we have are for real users who actively use the software.

We are designing a setup wizard which allows users to set preferences on what information they receive.

One of the settings is yes or no as to whether the application should send notifications via email. This raised debate as to what the default setting should be.

The argument for "no" was that users should explicitly give their permission to receive automated emails and therefore this was the correct default.

The argument for "yes" was that the users have implied consent because they are using an application whose sole purpose is to inform them about changes, and email delivery is the primary way of doing this.

The application is still usable if the user doesn't receive emails because the data which is present in the emails is visible inside a web-based interface. The disadvantage of using the application in this way is that - unless the user logs in - they will not necessarily be aware of any updates. Therefore defaulting email opt-in is preferable.

The pre-sale marketing material for the application makes it clear that email delivery is the main delivery method for the information and getting it directly to your inbox is an advantage of using the system.

The application allows the user to change their settings at any time. So if they opt-in to receive emails today, they can opt-out tomorrow, and vice versa. They can change their preferences at any time.

What are people's thoughts on this? We are based in the UK but deal with customers worldwide. Is this covered or referred to by GDPR?

Answer 1

GDPR does not require consent. It requires a legal basis. Consent is only one legal basis among many. Some other legal bases are:

• legitimate interest (implying an opt out solution)
• necessity for performance of a contract

If your customers pay you to deliver email updates, that contract is the legal basis for sending email updates. The only wrinkle is that as you describe your service, the emails aren't an essential part of the service.

Alternatively, you might assert that there's a legitimate interest to deliver updates via email so that updates aren't missed. In that case you must allow the users to object, e.g. via ab unsubscribe link in the email and via their account settings. Because a prior business relationship exists, there's a strong case for legitimate interest – even if this were marketing emails (!). Legitimate interest requires you to balance the legitimate interest with the data subject's rights and freedoms though.

Your updates are most likely not marketing, so any advice you might read relating to marketing emailings is irrelevant.

GDPR applies because you are established in the EU. The regulation applies in relation to all your users, not just EU users. If and when Brexit happens you will still be covered by the Data Protection Act, which transcribes the GDPR's requirements into UK law. However, processing data from EU users will then count as an international transfer which requires extra compliance work, at least until the EU issues an adequacy decision for the UK.