1

Now that Brexit has happened, GDPR no longer takes effect in UK.

However, the Data Protection Act 2018 will continue to apply.

With GDPR's Article 6, a website is required to request explicit consent to the user for sending Marketing e-mails (and allow to revoke at any point).

I would like to know if the same applies for UK at the moment.

Improve this question
2
  • 3
    Your premise is incorrect. All relevant EU regulations became UK legislation upon exit day, including the UK GDPR. See the ICO FAQ for details.
    – amon
    Apr 15, 2021 at 17:39
  • You are also looking at the wrong legislation. A6 GDPR does not require consent for sending marketing e-mails. That is to be found in the Privacy and Electronic Communications Regulations 2003 (as amended).
    – Francis Davey
    Apr 21, 2021 at 20:50

1 Answer 1

Reset to default
2

Pactical Law's page on UK GDPR says:

The UK GDPR is the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (EU GDPR) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419).

It is defined in section 3(10) of the Data Protection Act 2018 (DPA 2018), supplemented by section 205(4).

It includes the provisions of what was previously the applied GDPR, unless the context otherwise require

The UK ICO's page onThe UK GDPR says:

The GDPR is retained in domestic law now the transition period has ended, but the UK has the independence to keep the framework under review. The ‘UK GDPR’ sits alongside an amended version of the DPA 2018. The government has published a ‘Keeling Schedule’ for the UK GDPR, which shows the amendments.

The key principles, rights and obligations remain the same. However, there are implications for the rules on transfers of personal data between the UK and the EEA.

The UK GDPR also applies to controllers and processors based outside the UK if their processing activities relate to:

offering goods or services to individuals in the UK; or monitoring the behaviour of individuals taking place in the UK.

...

Section 2 of the 2018 UK Data Protection act provides that:

2 Protection of personal data

(1) The GDPR, the applied GDPR and this Act protect individuals with regard to the processing of personal data, in particular by—

(a) requiring personal data to be processed lawfully and fairly, on the basis of the data subject's consent or another specified basis ...

Nothing that I can find in the DPA restricts the application of GDSPR Article 6. The Keeling Schedule for the GDPR shows changes made by UK entitlement legislation. There is no relevant change to article 6 paragraph (1). However, there is no specific requirement for consent to marketing emails. Such emails, like all processing, must have a lawful basis, and consent of the data subject is one of the possible bases, and perhaps the most likely one for such a use.

Improve this answer
2
  • Hmm, I guess GDPR/DPA doesn't discuss emails. Relevant provisions might instead be in PECR, the UK's ePrivacy implementation.
    – amon
    Apr 16, 2021 at 6:57
  • 1
    @amon Not specifically that I can find. But sending an email is still a processing of personal information, and still needs a lawful basis under the GDPR (when it applies). But the basis does not have to be consent, any lawful basis will do. I haven't checked PECR, that may have more specific rules about email.
    – David Siegel
    Apr 16, 2021 at 13:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .