We are wondering if we can send another email to people who subscribed to our newsletter but never clicked on the confirmation link sent afterwards. Is it ok GDPR-wise?
1
-
2Personally I would say a second time is ok, but not more. Be aware that you are trying to get an e-mail confirmed because somebody other than the owner of it might have subscribed to your newsletter. And you don't want to bother people that didn't really subscribe themselves.– PMFApr 22, 2022 at 10:43
Add a comment
|
1 Answer
The GDPR does not specifically regulate sending emails. Sending an email is a form of processing the data that is the email address, whch is surely personal data (PD) and thus requires a lawful basis under GDPR Article 6.
As the comment by user PMF points out, confirmation of an email is normally requested because it is possible for someone to register someone else's email. If the confirmation is not completed, a data controller (DC) should consider the possibility that the initial subscription was in fact by someone other than the owner of the email address provided. There is no specific rule in the GDPR on how many times one may request confirmation in such circumstances. I would think it poor practice to overdo this. It might be good practice for any confirmation email to provide a link or address or means by which the person can communicate the concept "I did not subscribe". But nothing in the GDPR requires this, although a data erasure request would have much the same effect.
It might also be well in any confirmation request to remind the DS of his or her rights to request access, modification, or deletion of any PD held by the DC about the DS. This might be combined with the notice that the GDPR requires the DC to send to the DS after data about the DS has been acquired by the DC
answered Apr 22, 2022 at 16:27
