In many cases, you will need consent for the collection and use of personal data for direct marketing. According to the General Data Protection Regulation (GDPR), this consent must meet four requirements: "freely," "specifically," "informed" and "unambiguously.
ADVERTISEMENT
1. Free
A person should be free to give consent, but also to refuse or withdraw it. Does someone refuse to give consent? Then that should not cause you, for example, to refuse that person a service because consent was not given.
2. Specific
This means that there should be no doubt as to what specific use of the data someone has consented to. For example, it should be clear which data you want to use for direct marketing.
3. Informed
You must clearly inform people, before they give consent, about the processing of their personal data. You must do this in understandable language, so that people actually know what they are consenting to. So you will have to give a lot of information very openly and transparently, in a clear way.
Note: Are you requesting consent at the same time as you request acceptance of a contract? If so, you may not "hide" the consent as part of the contract. You must clearly and separately state the part about direct marketing.
4. Unambiguous
There must be a clear active act. For example, a (digital) written or oral statement. In any case, it must be absolutely clear that consent has been given. You may not use the principle 'silence means consent'. The use of pre-ticked boxes is therefore not permitted.
Providing to third parties
Do you want to provide your customers' personal data to third parties? If so, you need separate permission to do so. You must properly inform your customers which (categories of) third parties you provide personal data to.
Revoke consent
People who have given consent should be able to withdraw it at any time they wish via any email, text message or app you send. You must ensure that withdrawing consent is free and as easy as giving consent. So it is illegal to only allow people to withdraw their consent by mail or phone.
Proving consent
You must be able to prove that you actually obtained consent. This is part of the accountability you have under the AVG.
Note that in order to demonstrate valid consent, it is essential that you can show on the basis of what information someone gave consent. Thus, it is not enough just to record the consent itself.
