Note: This advice is given by the CAP Executive about non-broadcast advertising. It does not constitute legal advice. It does not bind CAP, CAP advisory panels or the Advertising Standards Authority.

Except in the case of 'corporate subscribers', marketers generally need consumers’ consent before using their personal data to send marketing communications by ‘electronic mail’.  If they are not sending ads by ‘electronic mail’, they are not obliged to rely on consent.  An exception exists for using contact details obtained during, or in negotiations for, a sale, provided the full requirements for this have been met (see our guidance on Data protection: Consent for full details).

They are also able to send marketing communications using personal data if they can demonstrate that this use of personal data is necessary for their ‘legitimate interests’.  This article explains the CAP Code rules that apply to ‘legitimate interests’.  For advice on the Code rules that apply to ads sent by electronic mail, see our guidance on Data protection: Consent.

This advice relates only to rules in CAP Code Section 10 (Use of data for marketing). It does not constitute legal advice on GDPR or any other legislation.  Marketers are encouraged to seek legal advice or consult the Information Commissioner’s Office (ICO) resources on this topic, such as the ICO Direct Marketing guidance. 

Read on to learn what the CAP Code says on these topics:

'Legitimate interests' definition

Legitimate interests is one of the six lawful bases for processing personal data under the UK GDPR.  It is a legal definition, and marketers are responsible for seeking appropriate legal advice if they wish to rely on this basis for using consumers’ personal data.

See the ICO’s guidance on legitimate interests.

 

‘Consent’ vs. ‘Legitimate interests’

Except in the case of corporate subscribers, marketers generally need consumers’ consent before using their personal data to send marketing communications by electronic mail.  An exception exists for contact details obtained during, or in negotiations for, a sale, provided the full requirements for this have been met. These requirements are explained further in our guidance on Data protection: Consent.

Marketers are not obliged to rely on consent if they want to send marketing communications using personal data through other media, such as direct mail by post.  They are also able to send marketing communications using personal data if they can demonstrate that using consumers’ personal data in this way is necessary for their legitimate interests.

If marketers rely on legitimate interests as their basis for using personal data to send ads by electronic mail, they will breach Code rule 10.5, (unless they are sending the ads to corporate subscribers in circumstances in which they can demonstrate that they have satisfied the requirements for relying on legitimate interests). 

 

Informing consumers about legitimate interests

Marketers need to provide consumers with information about their legitimate interests, if they intend to use this as a basis for sending marketing communications to the consumer.

They need to provide this information when they first collect the consumer’s personal data.  For example, they can provide this to the consumer in a privacy notice.

If marketers do not give consumers this information, or if they do it after they have already collected their personal data, they will breach Code rule 10.2.4.

 

Consumers’ right to object

Consumers have the right to object to this use of their personal data.  As soon as a consumer objects, marketers must stop processing their personal data.

Marketers must inform consumers of their right to object. They need to do this in their first communication with the consumer. 

If marketers do not do this, or if they inform consumers in a later communication, they will breach Code rule 10.13.

 

When ‘legitimate interests’ cannot be used

In summary, marketers cannot rely on ‘legitimate interests’ to use consumers’ personal data if:

  • they are sending marketing communications to individual subscribers by electronic mail
  • the legitimate interests are overridden by the interests, rights and freedoms of the consumer, particularly if the consumer is a child
  • the consumer has objected to this use of their data

Marketers should refer to the ICO guidance on interests, rights and freedoms of individuals.

 

See our advice on Data protection: General.

More on