Consent vs Legitimate Interest – What you need to know

Consent vs Legitimate Interest:

Understanding which legal basis best suits your needs is essential!  We know that both legitimate interest and consent have their benefits and downfalls when looking to communicate with consumers.  However, depending on the brand, industry sector or channel of communication one or the other can play a major role in the success of the marketing strategy.

What is Consent?

Consent is when the individual has given consent in the form of an ‘opt-in’ for a company to process their personal data for a specific purpose.

Consent requires an organisation to be named at the point of data capture and the consumer must ‘opt-in’ to be contacted by the brand, with the consent statement allowing for unbundled data collection with the boxes never pre-ticked i.e consent requires a positive /affirmative action to be recorded​.

It is often seen as the ‘safe’ option when it comes to collecting consumer data for marketing purposes.  Whether it is using a tick box or a subscription form, consent offers the consumer a clear choice, ultimately helping to build a brand’s reputation as trustworthy, transparent, and responsible, subject to the below guidelines also being followed:

  • The opt – in is a positive action – Reliant on the consumer ticking to receive communication (remember, no pre ticked boxes)
  • The statement of consent is clear and unambiguous
  • All third-party data controllers are named
  • Information on how to withdraw consent is clear and easy to find
  • The communication methods and content addressed to the consumer must then fulfil the purposes stated when consent with given

Consent is only one of the lawful bases under which companies can collect consumer data.  It gives consumers a choice whether to be communicated with, and by which channel, and ultimately can build a more trusting relationship when it comes to data transparency.

Remember – when data is collected via consent, and the purpose of collecting that data remains the same, it can then also be used under the legal basis of legitimate interest.

What is Legitimate Interest?

Legitimate interest is when you or a third-party have a genuine reason that makes processing the data necessary, and there are no other interests that outranks your business interest.  ​For example, your organisation may be able to demonstrate a legitimate interest in marketing your goods to existing customers in order to increase sales.

Legitimate Interest does not require an organisation to be named at the point of data capture as long as you can demonstrate that consumers would reasonably expect the data to be used for the purpose intended.  Best practice suggests that an organisation provides a descriptive list of sectors with whom personal data may be shared within their privacy policy.

Legitimate interest is another of the six lawful bases for processing consumer data for marketing purposes, in line with the ‘lawfulness, fairness and transparency’ regulations.  However, whereas consent is centred around a purpose, legitimate interest is more flexible and can apply to a wider range of consumer communications where needed.

When using consent, the consumer’s relationship with the brand is balanced and based on a transactional agreement.  When using legitimate interest, the purposes are often less transparent to the consumer but offers more flexibility for marketing purposes.  You can rely on using legitimate interest, if you can show how your use of the consumer data is proportionate, has a minimal personal impact and the consumer is unlikely to be surprised or object to what they receive.

To be clear, within the GDPR itself, Direct Marketing is specifically singled out as a legitimate interest.  It is important to note however, that unlike data which has been captured under consent, once data is collected under that basis of legitimate interest it cannot then be used for consent-based marketing.

How to apply a Lawful Bases:

Most lawful bases require that processing is ‘necessary’ for a specific purpose. If you can reasonably achieve the same purpose without the processing, you won’t have a lawful basis.  Remember, you must determine your lawful basis before you begin processing, and you should document it​.  Take care to get it right first time – you cannot swap to a different lawful basis at a later date without good reason.

Your privacy notice should include your lawful basis for processing as well as the purposes of the processing.  If your purpose does change, you may be able to continue processing under the original lawful basis if your new purpose is compatible with your initial purpose (unless your original lawful basis was consent).  If you are processing special category data, you need to identify both a lawful basis for general processing and an additional condition for processing this type of data.

Overall, both consent and legitimate interest serve a purpose. Consent builds a level of trust and brand awareness whilst enabling communication to consumers.  Legitimate interest on the other hand, helps brands target a broader consumer or prospect base.  There is no one size fits all when it comes to collecting data, so when choosing a lawful basis take care and don’t be afraid to ask for advice!

two hands shaking creating a heart shape

Check out more of our blogs on lawful bases or get in touch today for advice on data protection:

Contact us

Getting to grips with the lawful bases for processing data under GDPR (readgroup.co.uk)

Data Protection – REaD Group data and insight company

 

 

 

Our Voice

The latest data news and editorial from the team at REaD Group

Big Data for Small Businesses: Everything You Need to Know

August 15, 2022   Data

What is Data Quality? Why It’s Important

August 15, 2022   Data Quality

Data Quality Dimensions: What are They? And How to Use Them

August 12, 2022   Data

Data Quality Management: the What, Why and How

July 19, 2022   Data

Speak to one of our friendly advisors today